xpshims.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cfa3976df93642beaaa782b6499076f8_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cfa3976df93642beaaa782b6499076f8_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
cfa3976df93642beaaa782b6499076f8_JaffaCakes118
-
Size
180KB
-
MD5
cfa3976df93642beaaa782b6499076f8
-
SHA1
891c27af6c1a797085164825aca84d7ed26dd3e4
-
SHA256
0998f722fe29220fb272ed31cbce0db86c23d5ee93ae244279b2b50189f404d8
-
SHA512
5e1b575722863924219f3df2ae9d5599df97515455f388dab81f4df5b0f4826ef4e743f219b02d60d410a6e7c02190a7e0ae0752d166888e4250ac80341c2afc
-
SSDEEP
3072:Lrq/6DHEPauWchWDdsS6w/EDswYA9aIP1K/1vQGe9GV428CTKK48kePg1PhHD052:a/yEUXdd6w/EDW/1vFe9phCTKK4l9HQN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cfa3976df93642beaaa782b6499076f8_JaffaCakes118
Files
-
cfa3976df93642beaaa782b6499076f8_JaffaCakes118.dll windows:6 windows x86 arch:x86
47ee7012c872237fb8a7380517fbd8c0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
ntdll
NtQueryObject
RtlUnwind
kernel32
QueryPerformanceCounter
GetCurrentProcessId
GetProcAddress
VirtualProtect
VirtualQuery
GetCurrentThreadId
GetModuleHandleExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleA
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryExW
WaitForSingleObject
user32
FindWindowExA
GetClassNameW
GetWindowThreadProcessId
SetWindowsHookExW
shlwapi
ord157
ord158
ord156
iertutil
ord305
Exports
Exports
IEShims_Initialize
IEShims_Uninitialize
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 169KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ