C:\Work\Applet\__Partners\dll\Release\LinkSave2.pdb
Static task
static1
Behavioral task
behavioral1
Sample
049d0d145ad6e597e45aaf672aa0f682_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
049d0d145ad6e597e45aaf672aa0f682_JaffaCakes118
-
Size
176KB
-
MD5
049d0d145ad6e597e45aaf672aa0f682
-
SHA1
96a0790061dbf5f5ef746980420d225fab95e3a7
-
SHA256
19c3fc0fe96e3b83951562dac5264e673169b2d7efe17b28bed56de84a2c42ad
-
SHA512
a158c10e88006ec65e1430c88150073fc4cc4ec35ab0adc74bf549c2cebb969b4447dba78e005396de5a0476f57e4da6834d931bc1902336cd8eb1a74db4a6e9
-
SSDEEP
3072:TPx7wxG3vE5e4UqhOxxwbsErynXBcegMDuMWTBHgNMNHsJlvaq:T50kMf/AxwnynRPDu5uIM7n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 049d0d145ad6e597e45aaf672aa0f682_JaffaCakes118
Files
-
049d0d145ad6e597e45aaf672aa0f682_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
77616aaec936ee5e834a82547cbcffcb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
urlmon
URLOpenBlockingStreamA
kernel32
WideCharToMultiByte
RaiseException
GetLastError
InitializeCriticalSection
DeleteCriticalSection
lstrlenA
GlobalFree
lstrcpynA
GlobalAlloc
GetModuleFileNameA
CompareStringA
MultiByteToWideChar
GetStringTypeExA
InterlockedDecrement
UnmapViewOfFile
FlushFileBuffers
lstrcpyA
MapViewOfFile
CreateFileMappingA
GetTickCount
LCMapStringW
LCMapStringA
InterlockedCompareExchange
Sleep
FreeLibrary
GetVersionExA
GetLocaleInfoA
GetACP
InterlockedExchange
VirtualQuery
GetUserDefaultLCID
GetStringTypeW
LocalFree
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
GetStringTypeA
RtlUnwind
ExitProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
HeapReAlloc
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
QueryPerformanceCounter
GetCurrentProcessId
SetUnhandledExceptionFilter
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
LoadLibraryA
IsBadReadPtr
IsBadCodePtr
GetOEMCP
GetCPInfo
user32
wsprintfA
LoadStringA
advapi32
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA
oleaut32
SysAllocStringByteLen
SysFreeString
SysStringLen
SysAllocString
VariantClear
shlwapi
SHDeleteKeyA
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 128KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ