d:\td\tao96\tao96\Release\tao96.pdb
Static task
static1
Behavioral task
behavioral1
Sample
000543a5bd203c90cff2219a0456bcdf_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
000543a5bd203c90cff2219a0456bcdf_JaffaCakes118
-
Size
214KB
-
MD5
000543a5bd203c90cff2219a0456bcdf
-
SHA1
873d3d39fea34fffb4ccf03f00eea1ef5010866e
-
SHA256
b6ea3fbcd4ad4c5fc43cdd483f18d30385b75ea6bf0a80790865e812deed1fb3
-
SHA512
b48a53e9e04a442bfc8daf34db9ce1c82b5931c7314c1ac13639297523e4a81df2af9c4b2ff2edf12f81189d58dc65ed09acfae00d78f2b3da4aefaa94f04f0d
-
SSDEEP
3072:nz/lzdYhCjYaKbfUaTYWhknKbaP5Y3RwzNRSs/4ixDrnBDEYpegWoR5SpMEid:nvYQkTY0knK+citnBDEYpxXh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 000543a5bd203c90cff2219a0456bcdf_JaffaCakes118
Files
-
000543a5bd203c90cff2219a0456bcdf_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
00bccb441b2c5d5f2b8e8edfcfed0984
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LeaveCriticalSection
GetLastError
GetProcAddress
GetModuleHandleA
lstrlenA
lstrcmpiA
GetModuleFileNameA
GetModuleHandleW
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
EnterCriticalSection
LoadLibraryA
CloseHandle
WaitForSingleObject
CreateProcessA
CreateMutexA
GetLocalTime
SetThreadLocale
GetThreadLocale
HeapFree
GetProcessHeap
FlushFileBuffers
CreateFileA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
GetWindowsDirectoryA
RaiseException
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
ReadFile
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapAlloc
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCurrentThreadId
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA
LCMapStringW
VirtualFree
HeapReAlloc
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
user32
CharNextA
CharNextW
IsCharAlphaNumericA
advapi32
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
ole32
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
oleaut32
VariantClear
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysFreeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 91KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ