iepeers.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d742d6eadc49e0b21e94706fc098ebb9_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d742d6eadc49e0b21e94706fc098ebb9_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d742d6eadc49e0b21e94706fc098ebb9_JaffaCakes118
-
Size
277KB
-
MD5
d742d6eadc49e0b21e94706fc098ebb9
-
SHA1
76ddcb8eb5f6e1c0a884f311b85287eee993e6f6
-
SHA256
c7657ad732a6bdfc44bceba1f9df9ce3343cf45a084b2f53a9d46ac437b150a5
-
SHA512
7c3dbdbcf0cef81b52d3d45f08fdae5aac2b9e8d28f8535c1f291e1e60123c0b037d17e8d79f29f8d3e9bc2601e0ad40c5a3ea97d4393c997a9bac1ddae3ef75
-
SSDEEP
6144:ayL6YDiSCRPfBiQ0QmTkc01NeG4GVRDe7jdrTcc:a+LDiHBkRueDGHDskc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d742d6eadc49e0b21e94706fc098ebb9_JaffaCakes118
Files
-
d742d6eadc49e0b21e94706fc098ebb9_JaffaCakes118.dll regsvr32 windows:6 windows x86 arch:x86
71bcb4efe9ba0ea6a8e63f4c76df52d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_adjust_fdiv
_amsg_exit
_initterm
wcstol
wcschr
_wcsicmp
free
malloc
__dllonexit
_wcsnicmp
_ltow
_purecall
_vsnwprintf
??2@YAPAXI@Z
bsearch
wcsncmp
memset
memcpy
memmove
realloc
_unlock
_lock
_onexit
_XcptFilter
_wtoi
??3@YAXPAX@Z
kernel32
LocalAlloc
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
InitializeCriticalSectionAndSpinCount
SetLastError
FindResourceExW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
SearchPathW
CreateActCtxW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetProcAddress
LoadLibraryW
GetLocaleInfoW
MulDiv
GlobalUnlock
GlobalLock
LocalFree
GetDiskFreeSpaceA
WriteFile
GetSystemTimeAsFileTime
GetLastError
InterlockedDecrement
InterlockedIncrement
FileTimeToSystemTime
SystemTimeToFileTime
CompareStringW
LoadLibraryA
GetModuleFileNameA
GetFullPathNameA
SearchPathA
LoadLibraryExA
GetVersionExW
GetModuleFileNameW
lstrlenW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
lstrlenA
FreeLibrary
CreateFileW
CreateFileMappingW
CloseHandle
MapViewOfFile
UnmapViewOfFile
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetModuleHandleW
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
DisableThreadLibraryCalls
GetUserDefaultLCID
GlobalAlloc
GlobalFree
CompareFileTime
advapi32
GetUserNameW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
shlwapi
ord437
StrCmpW
ord418
PathAddBackslashW
SHRegGetValueW
StrCpyW
ord176
ord158
ord2
StrCmpIW
StrCpyNW
PathFindFileNameW
ord156
wnsprintfW
PathCombineA
PathAppendA
StrCmpNIW
StrDupW
SHGetValueW
ole32
CreateBindCtx
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
oleaut32
SafeArrayPutElement
SafeArrayCreate
SysFreeString
VariantClear
SysStringLen
VariantInit
SysAllocString
SafeArrayCreateVector
SysAllocStringLen
VariantChangeTypeEx
VariantCopy
VarI4FromStr
LoadRegTypeLi
SetErrorInfo
RegisterTypeLi
LoadTypeLi
gdi32
EndPage
StartDocW
EndDoc
CreateICW
GetDeviceCaps
SetViewportOrgEx
AbortDoc
StartPage
DeleteDC
CreateDCW
user32
GetDesktopWindow
CharNextW
MessageBoxW
LoadStringW
urlmon
FaultInIEFeature
CoInternetParseUrl
CreateUri
CoInternetCombineUrlEx
RegisterBindStatusCallback
CoInternetCreateSecurityManager
wininet
CreateUrlCacheContainerA
InternetCombineUrlW
InternetQueryOptionW
InternetGetConnectedStateExW
RetrieveUrlCacheEntryStreamW
GetUrlCacheEntryInfoW
FindCloseUrlCache
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
InternetCrackUrlW
CommitUrlCacheEntryW
CreateUrlCacheEntryW
UnlockUrlCacheEntryStream
ReadUrlCacheEntryStream
DeleteUrlCacheEntryW
shell32
ord25
SHGetFolderPathA
ord152
ord155
SHGetDesktopFolder
winspool.drv
OpenPrinterW
GetPrinterW
DocumentPropertiesW
DeviceCapabilitiesW
ClosePrinter
iertutil
ord32
ord309
ord58
ord166
ord163
Exports
Exports
DllCanUnloadNow
DllEnumClassObjects
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 97KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE