\\cpvsbuild\drops\ModWRRTMQFE\raw\5077\vsbuilt\retail\bin\i386\otkloadr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dcfada4cc887a121011e0b62af499eef_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dcfada4cc887a121011e0b62af499eef_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
dcfada4cc887a121011e0b62af499eef_JaffaCakes118
-
Size
168KB
-
MD5
dcfada4cc887a121011e0b62af499eef
-
SHA1
b36eb0b8c2959a73ea753e77a9b0c86e40adaed0
-
SHA256
e808d72a76986a69ea88598b37617e65f3750375cfbec903fa94264f10c55324
-
SHA512
671552cb5b038bfb8cf5b6272186d7b457c3527cea244b156494c954cee59788338a10329a24dc9be2af9a733c95e2ff6c0e6eb9d0290045cdd973dbfdda4c76
-
SSDEEP
3072:z3yM9j5rvelJmwdjoY0ZpLlF/FA1lWwKPWVfGf:d99rvHwdjEpjnWVfK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dcfada4cc887a121011e0b62af499eef_JaffaCakes118
Files
-
dcfada4cc887a121011e0b62af499eef_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
c0ed8cb3f44c1915f4cf2abbd9de8ef1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrcmpiW
lstrcpyW
GetModuleFileNameW
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
lstrcpynW
lstrcatW
LeaveCriticalSection
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
LockResource
FindResourceExW
GetProcAddress
LoadLibraryW
GetProcessHeap
HeapSize
EnterCriticalSection
RaiseException
lstrlenW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
FreeLibrary
InterlockedExchange
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
user32
CharNextW
advapi32
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
ole32
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
oleaut32
SafeArrayUnlock
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysAllocStringLen
SysStringLen
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SafeArrayDestroy
VarBstrCat
SysStringByteLen
SysAllocStringByteLen
SafeArrayRedim
SafeArrayCreate
VariantCopyInd
SafeArrayLock
wininet
InternetSetOptionW
InternetAutodial
InternetGetConnectedState
GetUrlCacheEntryInfoW
InternetCombineUrlW
urlmon
CoInternetQueryInfo
mscoree
CorBindToRuntimeEx
shlwapi
PathIsRelativeW
PathIsURLW
PathFindExtensionW
msvcr71
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__security_error_handler
__CppXcptFilter
_adjust_fdiv
_initterm
wcsrchr
memset
iswspace
wcslen
memmove
wcscspn
wcsspn
wcsstr
wcscmp
??_U@YAPAXI@Z
realloc
wcsncpy
_purecall
__CxxFrameHandler
??2@YAPAXI@Z
_except_handler3
_CxxThrowException
free
malloc
??_V@YAXPAX@Z
??3@YAXPAX@Z
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 568B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE