C:\projects\fixer\BLAS\English\_Source\_Release\FixCore.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e0d5be868ebc2cc3d8c76bbc54e83542_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e0d5be868ebc2cc3d8c76bbc54e83542_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
e0d5be868ebc2cc3d8c76bbc54e83542_JaffaCakes118
-
Size
54KB
-
MD5
e0d5be868ebc2cc3d8c76bbc54e83542
-
SHA1
b5e511bab0d80fc4ebdf59f832456a3356e7046b
-
SHA256
1d5bc0c3971a5b926f71932dfeedd2846543b75037f6e0866d9298db9cdb1085
-
SHA512
fc72d440c9dc1d33f5aac9d33149ed9bd9ee664a3e562a60b88e5e2719b9b59405cb84cf8cd40012ec821e2c4bdf2cf285d129ca6efd4a6bc2cba1ed22dd7fb5
-
SSDEEP
768:ZDmEe1Z2NnWx6EpR4O2g2wsXkqjg2bgB/8vGKX56Te:ZCr1ZV/j4Fg2wsXkq0grpX5j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e0d5be868ebc2cc3d8c76bbc54e83542_JaffaCakes118
Files
-
e0d5be868ebc2cc3d8c76bbc54e83542_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
971f38bb880e3991ad9663bd5f1fc94b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
mfc71
ord265
ord1191
ord1187
ord266
ord1917
ord765
ord315
ord1037
ord1206
ord1003
ord1098
ord371
ord1120
ord1201
ord1175
ord1177
ord1209
ord1084
ord1092
ord1167
ord581
ord723
ord531
ord310
ord2322
ord432
ord762
ord1970
ord304
ord3997
ord876
ord578
ord1185
ord314
ord1049
ord3683
ord764
ord2248
ord3830
ord757
ord566
ord3333
ord4261
ord4481
ord3949
ord2644
ord3709
ord3719
ord3718
ord2533
ord2646
ord2540
ord2838
ord2714
ord4307
ord2835
ord2731
ord2537
ord5566
ord5213
ord5230
ord4568
ord3948
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord1208
msvcr71
_strcmpi
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__security_error_handler
_onexit
__dllonexit
memset
_resetstkoflw
_except_handler3
free
_CxxThrowException
__CxxFrameHandler
realloc
atoi
malloc
__CppXcptFilter
_adjust_fdiv
_initterm
kernel32
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
LocalAlloc
LocalFree
GetModuleFileNameA
lstrlenA
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
MoveFileA
lstrlenW
WideCharToMultiByte
SetFileAttributesA
DeleteFileA
FindFirstFileA
FindClose
ReadFile
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
CreateFileA
SetLastError
GetFileSize
SetEndOfFile
GetLastError
WriteFile
CloseHandle
SetFilePointer
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
MultiByteToWideChar
GetDriveTypeA
ole32
CoCreateInstance
oleaut32
SysStringLen
LoadTypeLi
LoadRegTypeLi
SysFreeString
BSTR_UserUnmarshal
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserFree
atl71
ord15
ord18
ord22
ord64
ord23
ord61
ord32
ord58
ord31
rpcrt4
NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrStubForwardingFunction
NdrStubCall2
NdrOleAllocate
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 46B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ