setup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0bc523ff09e932bacd92545a5a7a91a7_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0bc523ff09e932bacd92545a5a7a91a7_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0bc523ff09e932bacd92545a5a7a91a7_JaffaCakes118
-
Size
171KB
-
MD5
0bc523ff09e932bacd92545a5a7a91a7
-
SHA1
49c24c42ab090170b08ba342911f1147b30dd140
-
SHA256
de52ad05f45a288ad93eba9456bfc50c2a6ee10e6b9b18b7552046b07978daa7
-
SHA512
1a4703fc10878d6710c07b9625816c4989332fc7afcdc486f2b40fd03ba1cac33c0c538c54419dc46c959add3744c82d06614a254574c1f6107cf36cba5c3777
-
SSDEEP
3072:FTpLQK4TC82MUICM+DeQYq9PTmpWMThJ38yshrc8Rxgrv5KP/PGDvm:/LQK4+82mCM+KQJPapWOL8ycRxGKP3GD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0bc523ff09e932bacd92545a5a7a91a7_JaffaCakes118
Files
-
0bc523ff09e932bacd92545a5a7a91a7_JaffaCakes118.dll windows:5 windows x86 arch:x86
926c13015a5ec841f580fcebbf7e50d4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
wprintf
wcsstr
printf
memset
free
exit
_wcslwr
_wcsdup
_ismbblead
_initterm
_exit
_controlfp
_cexit
_amsg_exit
__setusermatherr
__set_app_type
__p__fmode
__p__commode
__getmainargs
_XcptFilter
shell32
SHCreateDirectoryExW
SHGetSpecialFolderLocation
CommandLineToArgvW
user32
IsWindow
MessageBoxW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
kernel32
VirtualAlloc
UnhandledExceptionFilter
TerminateProcess
Sleep
SetUnhandledExceptionFilter
InterlockedExchange
VirtualFree
GetModuleHandleA
GetFullPathNameW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetCommandLineW
FindNextFileW
ExitProcess
VirtualProtect
lstrlenW
GetProcAddress
FindFirstFileW
gdi32
ArcTo
PolyDraw
Exports
Exports
APCMClose
CreateEnumFormatEtc
DeleteColumn
DestroyWindow
GenerateUniqueFileName
GetCurrentIndex
GetLogInfo
GetQueryParameterInfo
HrGetMsgParam
HrIsStreamUnicode
HrRtreamSeekCur
OpenWFileStreamWithFlags
PszFromANSIStreamA
Restore
Sections
.text Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ