blackbox_notestroot.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0f7e92b27db58a84114aca132062e98b_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
0f7e92b27db58a84114aca132062e98b_JaffaCakes118
-
Size
690KB
-
MD5
0f7e92b27db58a84114aca132062e98b
-
SHA1
330f90ae520483e47b163f8425a1f9fa074ed4a6
-
SHA256
b67fa7aa75df8ac6c3c63effcac744b675028fc7b57384bbc69b5f6134522abb
-
SHA512
903b3d4d52d68b2455b4035147ca4943022ab342f963ae7f54bc46d3778c8454757f2a19a04d6eeedd2047757c0fd9db4544643b880f558e2bd108fffc4d0ccf
-
SSDEEP
12288:QdR3x1PT2kmudWlL4IDvTaA4k+vX5W03/Lp7UMnV6Q8:Qj6km0WSIDvTam+vX5W0PTV6J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f7e92b27db58a84114aca132062e98b_JaffaCakes118
Files
-
0f7e92b27db58a84114aca132062e98b_JaffaCakes118.dll regsvr32 windows:6 windows x86 arch:x86
8cbe381d2dc956d4a2eeaa4e4cb8faec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
iswctype
malloc
free
wcsrchr
_wcsnicmp
_vsnwprintf
_errno
_vsnprintf
wcsncmp
atol
_wcsicmp
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
strrchr
memmove
_purecall
ntdll
RtlUnwind
advapi32
GetSecurityDescriptorDacl
CreatePrivateObjectSecurityEx
GetNamedSecurityInfoW
SetNamedSecurityInfoW
GetSecurityDescriptorSacl
DestroyPrivateObjectSecurity
RegSetKeySecurity
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
OpenProcessToken
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegDeleteValueW
mfplat
MFHeapFree
MFHeapAlloc
kernel32
ExpandEnvironmentStringsW
GetWindowsDirectoryW
GetSystemDirectoryW
LoadLibraryW
SetFileAttributesW
GetFileAttributesW
LocalFree
GetCurrentThread
GetVersion
GetSystemTime
FreeLibrary
SetFilePointer
FindClose
GetProcessAffinityMask
CreateThread
SetThreadAffinityMask
SetThreadPriority
ResumeThread
WaitForSingleObject
GetSystemInfo
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
LoadLibraryA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
CreateFileMappingW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
CreateDirectoryW
MultiByteToWideChar
OutputDebugStringA
TerminateProcess
SetUnhandledExceptionFilter
UnmapViewOfFile
MapViewOfFile
LocalAlloc
GetSystemTimeAsFileTime
InterlockedCompareExchange
SetLastError
ExitProcess
WideCharToMultiByte
DisableThreadLibraryCalls
GetLocalTime
QueryPerformanceCounter
GlobalMemoryStatus
InterlockedIncrement
InterlockedDecrement
HeapFree
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
GetProcAddress
GetModuleHandleA
CloseHandle
CreateFileA
UnhandledExceptionFilter
GetLastError
GetModuleFileNameA
HeapAlloc
Sleep
GetDiskFreeSpaceA
WriteFile
GetCurrentProcess
GetFileSize
CopyFileW
DeleteFileW
MoveFileW
GetTempFileNameW
GetTempPathW
ReadFile
CreateFileW
InterlockedExchange
GetModuleHandleW
DeviceIoControl
FreeEnvironmentStringsA
FreeEnvironmentStringsW
lstrlenA
lstrlenW
GetEnvironmentStrings
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
ole32
CoTaskMemFree
StringFromCLSID
CLSIDFromString
CoTaskMemAlloc
CoCreateGuid
wintrust
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
Exports
Exports
DllMain
DllRegisterServer
DllUnregisterServer
IBlackBox_CreateInstance
IBlackBox_CreateInstance2
IBlackBox_CreateInstanceEx
IBlackBox_CreateInstanceEx2
IBlackBox_DestroyInstance
Sections
.text Size: 458KB - Virtual size: 458KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE