C:\c\ext cab\ie\main\Release\main.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c20870479afee56e12e0849dac71e9f3_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
c20870479afee56e12e0849dac71e9f3_JaffaCakes118
-
Size
109KB
-
MD5
c20870479afee56e12e0849dac71e9f3
-
SHA1
e800c1d8863ac1a498d72a8610f72840c49deead
-
SHA256
dda1f21f267b356c523ce9abf20deda01ec78539797eda912ed72cb326d32e69
-
SHA512
fb43d79200052eeac5021e65abea56529ef261229ed04ad600c71585366a4d9fe21f0959dd5afd60228a1b9bb21461704fd015c2388c9f690ca6c6d50bbfe65a
-
SSDEEP
1536:3aM6GRvp9PDiRNnTlVsms4D6whBkqWsGV++1nyBAokZHXvUjZNCmSFg2A:3aM6wvoTA4DXA+NAfBXvUjfCmSFLA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c20870479afee56e12e0849dac71e9f3_JaffaCakes118
Files
-
c20870479afee56e12e0849dac71e9f3_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
d760c4b7035b85f2d5048de007c90a79
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleA
lstrlenA
lstrcmpiA
IsDBCSLeadByte
GetModuleFileNameA
FreeLibrary
InterlockedDecrement
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleW
SetThreadLocale
GetThreadLocale
VirtualAlloc
GetStringTypeW
InterlockedIncrement
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
HeapFree
GetProcessHeap
SizeofResource
HeapAlloc
LocalFree
LoadLibraryW
LCMapStringW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
HeapReAlloc
EncodePointer
DecodePointer
VirtualProtect
GetSystemInfo
VirtualQuery
RtlUnwind
GetCurrentThreadId
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
Sleep
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
user32
CharNextW
CharNextA
advapi32
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
ole32
CoCreateInstance
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
oleaut32
RegisterTypeLi
UnRegisterTypeLi
SysAllocString
SysAllocStringLen
LoadTypeLi
LoadRegTypeLi
DispCallFunc
VariantClear
VariantInit
VarUI4FromStr
SysFreeString
SysStringLen
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ