colbact.pdb
Static task
static1
Behavioral task
behavioral1
Sample
15635c7df15179bd803f7536da7c5f10_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
15635c7df15179bd803f7536da7c5f10_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
15635c7df15179bd803f7536da7c5f10_JaffaCakes118
-
Size
129KB
-
MD5
15635c7df15179bd803f7536da7c5f10
-
SHA1
cc96d7b46b3b1e987050aa8e3add09f773ed9263
-
SHA256
e8b5d7fbcb22c1cee70f3bdec5cae186d8387e8624209c7a286fe772edb398bf
-
SHA512
f910aa2ecde4bb69fde9e7ff5bba231d05432c1bbd38baade7a5f89f08502863cf1d9f61bb6e8270e9a7e5a23096d3ba2ac1928e49829d6debb5c7029811fdfa
-
SSDEEP
3072:mg4yFKYc6VKCZi5bxgp8BYvEZSj5ffpdwbeyWW2ZBDFJG:vWKvIjBYvaS1Jeb6ZBD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15635c7df15179bd803f7536da7c5f10_JaffaCakes118
Files
-
15635c7df15179bd803f7536da7c5f10_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
b40473997ab41bf162c9db5eabc88758
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
user32
DialogBoxParamW
CloseDesktop
GetThreadDesktop
SetThreadDesktop
OpenDesktopW
SetWindowPos
MapWindowPoints
GetClientRect
GetWindowRect
GetDesktopWindow
SetProcessWindowStation
OpenWindowStationW
GetProcessWindowStation
CloseWindowStation
SetDlgItemTextW
EndDialog
LoadStringW
kernel32
LoadLibraryW
WaitForSingleObject
CreateThread
CreateEventA
LeaveCriticalSection
EnterCriticalSection
InterlockedCompareExchange
GetSystemTimeAsFileTime
TlsSetValue
GetCurrentProcess
GetCurrentThread
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetLastError
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetSystemInfo
CreateSemaphoreA
Sleep
DelayLoadFailureHook
ReleaseSemaphore
lstrcpynW
FormatMessageW
LockResource
LoadResource
FindResourceW
GetExitCodeProcess
CreateProcessW
OutputDebugStringW
FindClose
DeleteFileW
SetFileAttributesW
FindNextFileW
FindFirstFileW
CreateDirectoryW
GetLocalTime
ExpandEnvironmentStringsW
DebugBreak
GetThreadContext
IsDebuggerPresent
LoadLibraryExW
OutputDebugStringA
FreeLibrary
GetProcAddress
lstrlenA
OpenFileMappingW
MapViewOfFile
OpenMutexW
CompareFileTime
CloseHandle
WideCharToMultiByte
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
lstrcpyW
lstrcatW
lstrlenW
GetModuleHandleW
GetModuleFileNameW
TlsAlloc
TlsFree
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
TlsGetValue
lstrcmpiW
ReleaseMutex
UnhandledExceptionFilter
SetEvent
ole32
StringFromGUID2
CoGetObjectContext
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
advapi32
ReportEventW
DeregisterEventSource
EqualSid
OpenThreadToken
OpenProcessToken
GetTokenInformation
GetLengthSid
CopySid
DuplicateToken
FreeSid
AllocateAndInitializeSid
RegNotifyChangeKeyValue
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
SetThreadToken
IsValidSid
RegisterEventSourceW
rpcrt4
UuidToStringA
UuidToStringW
RpcRevertToSelf
RpcImpersonateClient
UuidFromStringA
RpcStringFreeA
RpcStringFreeW
version
VerQueryValueW
msvcrt
_except_handler3
wcslen
_resetstkoflw
time
srand
rand
malloc
_onexit
__dllonexit
_adjust_fdiv
_initterm
free
_wstrdate
_wstrtime
_local_unwind2
_waccess
wcsrchr
__CxxFrameHandler
wcscmp
floor
_CIfmod
_vsnwprintf
ntdll
RtlImageNtHeader
RtlFreeHeap
RtlAllocateHeap
secur32
GetUserNameExW
Exports
Exports
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetClassInfoForCurrentUser
GetDefaultPartitionForCurrentUser
GetDefaultPartitionForSid
PartitionAccessCheck
Sections
.text Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ