wpdmtp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
06bb98921471e2bab7a96f21e7d89e87_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
06bb98921471e2bab7a96f21e7d89e87_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
06bb98921471e2bab7a96f21e7d89e87_JaffaCakes118
-
Size
167KB
-
MD5
06bb98921471e2bab7a96f21e7d89e87
-
SHA1
f843b2496bc465072e7cfa70a0b7e40529757ce2
-
SHA256
bcb251b0cfde43e3e07c3d19ded6ce9b8f4d4ada2fdca70597d08232c6960b42
-
SHA512
883302ec0f312e2735e1e1f0067c3d950a1671f39c87c6882d1d046b88da1867535ce32f9b374f1c9149e2ea549a9dcb2fff465819f92f78d0dbd02652565e92
-
SSDEEP
3072:SQ+0LloO0GyvoaymERPVt7V9kr9PrK/HMeI3I:J70G+oa/C7k9e/H2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 06bb98921471e2bab7a96f21e7d89e87_JaffaCakes118
Files
-
06bb98921471e2bab7a96f21e7d89e87_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
7a7fc9cebf934fa70860a32f29cd2478
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
DisableThreadLibraryCalls
lstrcpynW
lstrcatW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
CreateThread
CloseHandle
WaitForSingleObject
HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
lstrcmpiW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
FormatMessageA
InterlockedCompareExchange
GetLocalTime
ExpandEnvironmentStringsW
CreateDirectoryW
CreateMutexW
CreateFileW
ReleaseMutex
LocalFree
GetSystemDirectoryA
lstrcatA
LoadLibraryA
LoadLibraryW
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
lstrcmpA
lstrlenA
WideCharToMultiByte
GetVersionExA
Sleep
GetLastError
LeaveCriticalSection
EnterCriticalSection
lstrcpyW
InterlockedExchange
lstrlenW
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
GetCurrentProcess
msvcrt
_onexit
__dllonexit
_adjust_fdiv
_initterm
wcscmp
wcsstr
wcstod
wcsrchr
wcslen
_wcsnicmp
realloc
wcsncpy
_purecall
??2@YAPAXI@Z
malloc
??3@YAXPAX@Z
free
_except_handler3
strncat
strncpy
_splitpath
_vsnprintf
_vsnwprintf
_snprintf
ntdll
memset
advapi32
RegCreateKeyExW
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExW
RegQueryValueExA
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW
user32
CharNextA
CharUpperA
CharNextW
oleaut32
SysStringLen
VariantClear
VariantCopy
VariantInit
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SafeArrayCreateVector
SafeArrayGetElemsize
SysAllocStringLen
shlwapi
PathFindExtensionW
ole32
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ