e:\im_client\source\thunk\src\Http\HttpPlugin\Product Release\HttpPlugin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0e22fc8b9d0bc920d52607285c2e8f88_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
0e22fc8b9d0bc920d52607285c2e8f88_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0e22fc8b9d0bc920d52607285c2e8f88_JaffaCakes118
-
Size
84KB
-
MD5
0e22fc8b9d0bc920d52607285c2e8f88
-
SHA1
daf6b1b9ecc1f66e7e5d570976199b5c13603fae
-
SHA256
79b45a9a12051c40af3c52e983d99b30c6c5840a77d482edeb89597cef54f7f8
-
SHA512
3da29269acd78bbfc6438593ddf5a826650b70c6dedc81d2588dc748824a444fca346e2a3f9f645e9c88b74000ef0b8bf18a15c4f09cd6feec9e17deb7f17d03
-
SSDEEP
1536:7CWpkA6f98Pjs5JInCMh5Qh5l7EOTfksu9d1Z9YBiDQwciOGdug:mWpkAu98rswnCM4hj5uH1Z9YBcQRiOGk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e22fc8b9d0bc920d52607285c2e8f88_JaffaCakes118
Files
-
0e22fc8b9d0bc920d52607285c2e8f88_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
395888ea0feec6b76ba62caca79c79ee
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
DeleteCriticalSection
GetLastError
lstrcmpiW
lstrcpynW
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
InitializeCriticalSection
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
lstrcatW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
RaiseException
lstrcpyW
lstrlenW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
SizeofResource
InterlockedExchange
GetTickCount
QueryPerformanceCounter
ExitProcess
GetVersionExA
user32
CharNextW
advapi32
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
ole32
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
oleaut32
SysAllocString
RegisterTypeLi
VarUI4FromStr
SysFreeString
LoadTypeLi
UnRegisterTypeLi
shlwapi
PathFindExtensionW
msvcp71
?_Nomemory@std@@YAXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
msvcr71
strncmp
_itoa
__CppXcptFilter
_adjust_fdiv
_initterm
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
__security_error_handler
??3@YAXPAX@Z
__CxxFrameHandler
malloc
free
_CxxThrowException
_except_handler3
??_V@YAXPAX@Z
_purecall
realloc
memmove
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
strchr
strstr
_stricmp
wcsncpy
atoi
memset
_callnewh
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 504B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ