udhisapi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
eaa299a1317ca66531ea2e33db224fa0_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eaa299a1317ca66531ea2e33db224fa0_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
eaa299a1317ca66531ea2e33db224fa0_JaffaCakes118
-
Size
81KB
-
MD5
eaa299a1317ca66531ea2e33db224fa0
-
SHA1
0baf131df49db7abaaff4fd2408436ead04aed29
-
SHA256
55457bb3752e78c0ba21bc5552f4de3ee418b8b29c644a199f3cc96569669449
-
SHA512
4da9a07bc55358ceee4b620080ed5e30e0e0cddd496500547e250c2a9679f8a2d012af9e36014c9e33be8680ddcce11bdde35380924b94853ab4404671f1d9c7
-
SSDEEP
1536:rBPJeLb6vpabJ8eMTAueRmW0auK2rP7cyAvLGVlwmd:rBYKEJ8eMTb6mcAcycLGVBd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eaa299a1317ca66531ea2e33db224fa0_JaffaCakes118
Files
-
eaa299a1317ca66531ea2e33db224fa0_JaffaCakes118.dll windows:5 windows x86 arch:x86
73bd78b04960280742e57ac4e7d87631
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_adjust_fdiv
malloc
_initterm
free
_strcmpi
_vsnprintf
_vsnwprintf
strtoul
isdigit
strtok
strncpy
wcsstr
wcscmp
_wcsicmp
isupper
tolower
strstr
strncmp
_strnicmp
kernel32
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
WideCharToMultiByte
HeapFree
lstrlenA
lstrcpyA
InterlockedCompareExchange
GetLastError
lstrlenW
lstrcmpW
MultiByteToWideChar
lstrcpynA
lstrcmpiA
QueryPerformanceCounter
GetTickCount
GetProcessHeap
ole32
CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
CoInitializeEx
CoCreateInstance
oleaut32
VariantClear
SysAllocString
SysStringLen
VariantInit
SysFreeString
wsock32
ioctlsocket
rpcrt4
UuidFromStringW
Exports
Exports
GetExtensionVersion
HttpExtensionProc
TerminateExtension
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ