colbact.pdb
Static task
static1
Behavioral task
behavioral1
Sample
261deeeb7ce0692f5c67d3ae88b4473d_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
261deeeb7ce0692f5c67d3ae88b4473d_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
261deeeb7ce0692f5c67d3ae88b4473d_JaffaCakes118
-
Size
217KB
-
MD5
261deeeb7ce0692f5c67d3ae88b4473d
-
SHA1
ce7a82d454d4ae302df75bfc23f79937bd8d59ce
-
SHA256
bbeff97ca20160e97e193f063bea32aecc3eabc038b62d6fa41ef8bde59af699
-
SHA512
6fa36f497cfa098206e5f7e167c85f01355823c1f9556133316286b67eb32d24647dc6d0301f52eff78adbfbb35adb7ab3ce12a953fe1a982a286ef085b4a944
-
SSDEEP
6144:Jrm0F2IBWHTWIlLt+qZ5x93pFfGAEBilDYi:pm0APHTllLtHjxbFfGS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 261deeeb7ce0692f5c67d3ae88b4473d_JaffaCakes118
Files
-
261deeeb7ce0692f5c67d3ae88b4473d_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
127ecfe0f071b45c17e1d5e0210c300b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
advapi32
GetLengthSid
CopySid
IsValidSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
EqualSid
DeregisterEventSource
RegQueryValueExW
DuplicateToken
FreeSid
AllocateAndInitializeSid
RegNotifyChangeKeyValue
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegisterEventSourceW
ReportEventW
RegCloseKey
comres
COMResModuleInstance
kernel32
InitializeCriticalSection
TlsFree
TlsAlloc
GetModuleFileNameW
GetModuleHandleW
lstrlenW
lstrcatW
lstrcpyW
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
GetProcAddress
FreeLibrary
OutputDebugStringA
GetLastError
LoadLibraryW
VirtualAlloc
CreateThread
CreateEventA
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
GetTickCount
InterlockedExchange
InterlockedCompareExchange
CloseHandle
TlsSetValue
TlsGetValue
lstrcmpiW
GetCurrentThread
DisableThreadLibraryCalls
QueryPerformanceCounter
GetCurrentThreadId
VirtualProtect
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
GetVersionExA
GetSystemInfo
CreateSemaphoreA
Sleep
SetEvent
ReleaseSemaphore
lstrcpynW
FormatMessageW
LockResource
LoadResource
FindResourceW
ReleaseMutex
FindClose
DeleteFileW
SetFileAttributesW
FindNextFileW
FindFirstFileW
GetExitCodeProcess
CreateProcessW
ExpandEnvironmentStringsW
CreateDirectoryW
GetLocalTime
DebugBreak
GetThreadContext
IsDebuggerPresent
LoadLibraryA
CreateFileW
GetWindowsDirectoryW
CreateMutexW
WriteFile
SetFilePointer
LocalFree
lstrcatA
lstrcpyA
GetModuleFileNameA
VirtualQueryEx
DeleteCriticalSection
DelayLoadFailureHook
OpenMutexW
CompareFileTime
MapViewOfFile
OpenFileMappingW
GetCurrentProcess
LoadLibraryExW
msvcrt
wcscpy
sprintf
wcsrchr
_vsnwprintf
_waccess
_wstrtime
_wstrdate
__CxxFrameHandler
malloc
wcslen
_initterm
_adjust_fdiv
__dllonexit
_onexit
_CIfmod
_ftol
floor
_except_handler3
free
_purecall
rand
srand
time
wcscat
wcscmp
ntdll
RtlInitializeCriticalSection
DbgPrint
ole32
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoGetObjectContext
rpcrt4
RpcStringFreeW
UuidToStringW
RpcStringFreeA
UuidFromStringA
RpcRevertToSelf
RpcImpersonateClient
UuidToStringA
secur32
GetUserNameExW
user32
LoadStringW
wsprintfW
CloseDesktop
GetThreadDesktop
SetThreadDesktop
OpenDesktopW
DialogBoxParamW
EndDialog
SetDlgItemTextW
CloseWindowStation
GetProcessWindowStation
OpenWindowStationW
SetProcessWindowStation
GetDesktopWindow
GetWindowRect
GetClientRect
wsprintfA
SetWindowPos
MapWindowPoints
version
VerQueryValueW
Exports
Exports
ServiceMain
DllRegisterServer
DllUnregisterServer
GetClassInfoForCurrentUser
GetDefaultPartitionForCurrentUser
GetDefaultPartitionForSid
PartitionAccessCheck
Sections
.text Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 159KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ