msadomd.pdb
Static task
static1
Behavioral task
behavioral1
Sample
092eed7bf83f3d6b6539854ed3fcc59c_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
092eed7bf83f3d6b6539854ed3fcc59c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
092eed7bf83f3d6b6539854ed3fcc59c_JaffaCakes118
-
Size
344KB
-
MD5
092eed7bf83f3d6b6539854ed3fcc59c
-
SHA1
900be246930a0802610cb1eb4e730fb4667d72e6
-
SHA256
a63e1a46024a9ce19f73f420109be1562d1fa53dd7f2018968674d2eb897d361
-
SHA512
206789b9f02fba65cc95306dc3e9b27b15d4cb963e93e58f8045b5bfa46a4121f7766bd4b632d0e03a1ea403112c346f14fa4ad96313217ac5e97b870a0cc826
-
SSDEEP
6144:/yzlr7bmWMvH7xTArkArfxyT6+lt+fKxf/kcbf16W6ee:/srfxKH+fKh16Je
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 092eed7bf83f3d6b6539854ed3fcc59c_JaffaCakes118
Files
-
092eed7bf83f3d6b6539854ed3fcc59c_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
5c818a3eeb12ae2049334329081f0668
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_adjust_fdiv
malloc
free
realloc
wcslen
_purecall
sprintf
_wcsicmp
_ftol
wcscat
memmove
swprintf
_onexit
__dllonexit
_except_handler3
_initterm
msdart
LoadLibraryI
PostMessageI
GetWindowsDirectoryI
_LoadVersionedResourceEx@16
??0CReaderWriterLock3@@QAE@XZ
?WriteLock@CReaderWriterLock3@@QAEXXZ
?WriteUnlock@CReaderWriterLock3@@QAEXXZ
?ReadOrWriteLock@CReaderWriterLock3@@QAE_NXZ
?ReadOrWriteUnlock@CReaderWriterLock3@@QAEX_N@Z
??1CReaderWriterLock3@@QAE@XZ
FXMemAttach
MpGetHeapHandle
FXMemDetach
GetModuleHandleI
LoadLibraryExI
FindResourceI
RegDeleteValueI
lstrcatI
GetModuleFileNameI
MpHeapAlloc
LoadStringI
RegEnumKeyExI
lstrcpynI
lstrlenI
RegSetValueExI
RegOpenKeyExI
RegCreateKeyExI
RegQueryValueExI
RegQueryInfoKeyI
lstrcmpiI
RegDeleteKeyI
MPDeleteCriticalSection
MPInitializeCriticalSection
CharNextI
MpHeapFree
UMSEnterCSWraper
GetVersionExI
lstrcpyI
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
EnterCriticalSection
CompareStringW
LCMapStringW
LCMapStringA
CompareStringA
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetUserDefaultLCID
TlsFree
TlsAlloc
TlsGetValue
TlsSetValue
DisableThreadLibraryCalls
IsBadCodePtr
LoadLibraryA
GetProcAddress
LoadResource
SizeofResource
lstrlenA
FreeLibrary
HeapDestroy
GetCurrentProcess
CloseHandle
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
GetLastError
InterlockedExchange
advapi32
RegCloseKey
ole32
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemRealloc
oleaut32
SysStringLen
SysAllocStringLen
VariantInit
VariantClear
VariantCopy
SysAllocString
VariantChangeType
LoadRegTypeLi
SetErrorInfo
VarI4FromStr
CreateErrorInfo
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
GetErrorInfo
OaBuildVersion
SafeArrayDestroy
SafeArrayUnlock
SafeArrayCopy
SysFreeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 128KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sdbid Size: 172KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ