WMM2AE.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ef6a3bf9ad7e5e72d33facf97c6ba2b0_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
ef6a3bf9ad7e5e72d33facf97c6ba2b0_JaffaCakes118
-
Size
262KB
-
MD5
ef6a3bf9ad7e5e72d33facf97c6ba2b0
-
SHA1
208603c856122a06972a32bc0c41aee135349f41
-
SHA256
84ba6356051cc6ba227db072de1a1b83bdc6687e0dbffcdfdc15180b57837b1a
-
SHA512
907c0b1f8218365de9a694518c15fab9e9996fd965457e2c865999df704b74e116c13c4094c834b6c6aef5fa53f4b3990a21c665d57547fbf83b621b51644a41
-
SSDEEP
6144:Ya/q6ZIvPT5C8lT8Vn3kgIRGMliNT5cR5EG6i0WTi4JlhsElDEG5:b/qPvFC0T81a8hNT56Efi0W24qExp5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef6a3bf9ad7e5e72d33facf97c6ba2b0_JaffaCakes118
Files
-
ef6a3bf9ad7e5e72d33facf97c6ba2b0_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
301e8f9d0e32aa6e055b52228c5fc6d8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_initterm
_adjust_fdiv
__dllonexit
_onexit
malloc
_wcsicmp
??2@YAPAXI@Z
realloc
free
_ftol
_purecall
wcsncpy
__CxxFrameHandler
fclose
wcscat
wcscpy
wcslen
wcsrchr
printf
_wcsnicmp
rand
srand
time
_CIexp
_wsplitpath
_except_handler3
??3@YAXPAX@Z
kernel32
lstrlenW
LoadLibraryA
CompareFileTime
GetTickCount
GetTempFileNameW
GetTempPathW
lstrcpyW
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
lstrcatW
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
DisableThreadLibraryCalls
GetShortPathNameW
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrcpynW
lstrcmpW
Sleep
CreateEventA
GetCurrentThread
GetThreadPriority
CreateThread
SetThreadPriority
SetEvent
WaitForSingleObject
GetSystemInfo
IsBadWritePtr
FormatMessageW
LocalFree
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetLastError
CloseHandle
user32
CharNextW
GetDC
ReleaseDC
PostMessageW
SendMessageW
LoadStringW
ole32
CoFreeUnusedLibraries
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
oleaut32
SysStringLen
SysFreeString
SysAllocStringLen
VariantClear
SysAllocString
LoadTypeLi
RegisterTypeLi
LoadRegTypeLi
gdi32
GetStockObject
GetObjectA
DeleteObject
advapi32
RegEnumValueW
RegOpenKeyExW
RegCloseKey
GetUserNameW
gdiplus
GdipDeleteFont
GdipDeleteFontFamily
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipFree
GdipBitmapUnlockBits
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetFamilyName
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipBitmapLockBits
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipGetFamily
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ