msdaps.pdb
Static task
static1
Behavioral task
behavioral1
Sample
08b76bc8110309cf9cfc64945853b177_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
08b76bc8110309cf9cfc64945853b177_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
08b76bc8110309cf9cfc64945853b177_JaffaCakes118
-
Size
207KB
-
MD5
08b76bc8110309cf9cfc64945853b177
-
SHA1
e89c3a11294731e517aa671a10c9cb6903600040
-
SHA256
b73c9617e2a7d1735f415e136f0f2c050f753bcea8e9cbe6c1769cd085fbc241
-
SHA512
85eb95ed9555c0b734eac7c95643d8c2cb79f4875bc80d77734404bd10728d37ec750eb1a2ef38bf978cb05a6e274e8e91005dc6e07a93dace91dbd4203ee8e9
-
SSDEEP
3072:Hch9yxsFD0PaUc1fZGKkYgkGJhD9NorGyIATR28FkjRdq425HQ:8jFs/sfVGthyIG2KkjbzK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08b76bc8110309cf9cfc64945853b177_JaffaCakes118
Files
-
08b76bc8110309cf9cfc64945853b177_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
6c8d6a25c1cdbf54126f8f32bb60aeeb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_onexit
__dllonexit
_adjust_fdiv
_initterm
realloc
malloc
_ultoa
free
wcscmp
wcscpy
wcslen
memmove
sprintf
_except_handler3
time
srand
rand
oleaut32
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
BSTR_UserFree
LPSAFEARRAY_UserSize
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
VARIANT_UserFree
VARIANT_UserUnmarshal
VARIANT_UserMarshal
VARIANT_UserSize
SetErrorInfo
GetErrorInfo
SysFreeString
VariantClear
SafeArrayDestroy
VariantInit
SysStringByteLen
rpcrt4
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrClientCall2
NdrStubCall2
NdrCStdStubBuffer2_Release
NdrStubForwardingFunction
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
msdart
mpMalloc
UMSEnterCSWraper
MPInitializeCriticalSection
MPDeleteCriticalSection
mpFree
kernel32
GetCurrentThread
GlobalAlloc
GlobalFree
GetVersion
GetModuleHandleA
GetProcAddress
LocalAlloc
lstrcmpA
lstrlenA
LocalFree
WideCharToMultiByte
CreateMutexA
GetLastError
CreateFileMappingA
MapViewOfFile
VirtualAlloc
WaitForSingleObject
CloseHandle
UnmapViewOfFile
VirtualFree
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocalTime
SystemTimeToFileTime
ReleaseMutex
LeaveCriticalSection
GetModuleFileNameA
DisableThreadLibraryCalls
GetSystemInfo
InterlockedIncrement
InterlockedDecrement
GetVersionExW
advapi32
OpenThreadToken
OpenProcessToken
GetTokenInformation
LookupPrivilegeValueW
GetSecurityInfo
SetEntriesInAclW
SetSecurityInfo
RegOpenKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
ole32
CoGetMalloc
CoCreateInstance
PropVariantClear
CoCreateGuid
CoReleaseMarshalData
CoGetMarshalSizeMax
CoMarshalInterface
CoUnmarshalInterface
CoDisconnectObject
CoRevertToSelf
CoImpersonateClient
CoSetProxyBlanket
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 172KB - Virtual size: 169KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 4KB - Virtual size: 522B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ