D:\RnD\Client\IE\Dev\6.0.2\Setup\AutomaticUpdate\Release\AutomaticUpdate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dadb69f5d6e67c0a58d242649e6f9a30_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dadb69f5d6e67c0a58d242649e6f9a30_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
dadb69f5d6e67c0a58d242649e6f9a30_JaffaCakes118
-
Size
263KB
-
MD5
dadb69f5d6e67c0a58d242649e6f9a30
-
SHA1
15f6ae293857f6cd4262617e09d915675dade627
-
SHA256
44262aa4e296786cf45596b53ca5c775df5bcc3186b2271f44bd23e7bf5c43f2
-
SHA512
7e1f82cd86a6264bcbb3d01f9d8850ac887cb01a4923c063a2ca3c8d262bf6f05caa0a06b018a9c929b03b2db2dae60aa8ea2f8ea76b4daa37c0ed7af041525c
-
SSDEEP
6144:6pL1dMzzseLK80agZtXUMjkGgcD4mzMcM6lFoLXH:o/MzzseLn0a+VUMjRgcD4aMcMR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dadb69f5d6e67c0a58d242649e6f9a30_JaffaCakes118
Files
-
dadb69f5d6e67c0a58d242649e6f9a30_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
be9f6a6153f1d41a974e20133df6e059
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
LockResource
GetProcAddress
GetLastError
LocalAlloc
LocalFree
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetTickCount
GetVersionExA
DeleteFileW
GetModuleFileNameW
GetLongPathNameW
GetModuleHandleA
GetComputerNameW
MultiByteToWideChar
WideCharToMultiByte
GetSystemTimeAsFileTime
CreateFileW
ReadFile
GetTempPathW
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
TlsAlloc
TlsSetValue
TlsGetValue
LoadLibraryA
GetLocalTime
GetCommandLineA
HeapAlloc
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointer
GetFileType
RaiseException
RtlUnwind
GetModuleHandleW
TlsFree
InterlockedIncrement
SetLastError
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
FlushFileBuffers
LCMapStringA
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
CreateFileA
SizeofResource
LoadLibraryW
OutputDebugStringW
WaitForSingleObject
CreateProcessW
LoadResource
FreeLibrary
FindResourceW
shlwapi
PathFileExistsW
PathFindFileNameW
user32
IsWindowVisible
RegisterWindowMessageW
IsWindow
SendMessageA
advapi32
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
RegCloseKey
RegCreateKeyExW
GetUserNameW
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
shell32
SHCreateDirectoryExW
SHGetFolderPathW
Exports
Exports
DllOnUpdateFinish
DllRegisterServer
Sections
.text Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ