c:\build\products\windows\soavcm\vc9build\Win32\Release\savmscm.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d27c54bf797b31aaa61356d8f42dd4ff_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d27c54bf797b31aaa61356d8f42dd4ff_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d27c54bf797b31aaa61356d8f42dd4ff_JaffaCakes118
-
Size
235KB
-
MD5
d27c54bf797b31aaa61356d8f42dd4ff
-
SHA1
43bd26dcf6034ff7162064978db74cbdc2661fe2
-
SHA256
cbec0bb0449f8e48651a5f0dc38355e11a1ff825722ecd51175978d97f50fa69
-
SHA512
8e0ed7a4d2cae0f9d6583eb1df0554184323a7ed5fb25c1c00879f479b1a704d42b4e14021d3162970fe6e5e0aff7f41dafde0247bca539de98965061cf2ae87
-
SSDEEP
3072:god8TzKKWFvoZAdj8EVJiKtX8RRoVOrspNEMTO0o4knmtZDB2btbd2Yi+qri5J2q:gjz1WFvoZAdHtX8ROOrgyNwDdbC21o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d27c54bf797b31aaa61356d8f42dd4ff_JaffaCakes118
Files
-
d27c54bf797b31aaa61356d8f42dd4ff_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
c552f7abf63c9acfd7933b1549b52519
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
lstrcmpiW
DisableThreadLibraryCalls
DeleteCriticalSection
RaiseException
GetProcAddress
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
LoadLibraryExW
LeaveCriticalSection
LocalFree
LocalAlloc
FormatMessageW
CompareStringW
CompareStringA
CreateFileA
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
GetLastError
lstrlenW
GetModuleFileNameW
EnterCriticalSection
GetModuleHandleW
GetTimeZoneInformation
GetProcessHeap
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
CreateFileW
RtlUnwind
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
FatalAppExitA
VirtualAlloc
HeapReAlloc
HeapSize
WriteFile
GetStdHandle
GetModuleFileNameA
Sleep
ExitProcess
CloseHandle
SetHandleCount
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
LoadLibraryA
GetLocaleInfoW
GetLocaleInfoA
InterlockedExchange
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
ReadFile
SetEnvironmentVariableA
user32
CharNextW
wsprintfW
advapi32
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
ole32
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoFreeUnusedLibraries
CoLoadLibrary
oleaut32
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
RegisterTypeLi
VarUI4FromStr
SysFreeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 176KB - Virtual size: 175KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ