adsmsext.pdb
Static task
static1
Behavioral task
behavioral1
Sample
26e82d1a1e5165a97befd7da15d5ac06_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
26e82d1a1e5165a97befd7da15d5ac06_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
26e82d1a1e5165a97befd7da15d5ac06_JaffaCakes118
-
Size
67KB
-
MD5
26e82d1a1e5165a97befd7da15d5ac06
-
SHA1
ee05a7eca6568e3be150289fa2534f4e22dc2fd2
-
SHA256
710fc7aa0020e0f5a2d8a8f5fb2fa8f2081fdadfe03689fee05da5f6a7b3b3df
-
SHA512
a1a8ff1d1be6655d837f442407b7d41dd265fae79ebd0731514631d051625c4c773406fbd8d5a2280bd92366264f18c91ed10d4f0d22380a29fc9d3ba86b2c1d
-
SSDEEP
1536:kyn0E5iA3qsmKkMawmG6E33i2+fJTvVYL4V:kyn/5p3mKkMawmG67TNYL4V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26e82d1a1e5165a97befd7da15d5ac06_JaffaCakes118
Files
-
26e82d1a1e5165a97befd7da15d5ac06_JaffaCakes118.dll windows:5 windows x86 arch:x86
5a5cd7a1eec692421a9c35582f680ec9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_except_handler3
_adjust_fdiv
malloc
_initterm
free
_wcsnicmp
_purecall
wcscat
wcscpy
wcslen
wcstok
swscanf
_wcsicmp
wcscmp
sprintf
wcschr
activeds
ord7
ord15
ord17
ord18
ord9
ord16
ord3
ord14
adsldpc
ADsObject
ReadServerSupportsIsADControl
LdapGetSyntaxOfAttributeOnServer
FreeObjectInfo
LdapCompareExt
ChangeSeparator
BuildADsPathFromLDAPPath
LdapReadAttributeFast
LdapValueFree
BuildLDAPPathFromADsPath2
GetDefaultServer
LdapCrackUserDNtoNTLMUser
LdapCrackUserDNtoNTLMUser2
LdapCloseObject
LdapOpenObject
LdapModifyS
wldap32
ord12
netapi32
NetUserSetInfo
NetUserChangePassword
ole32
CoCreateInstance
winspool.drv
SetPrinterW
OpenPrinterW
GetPrinterW
ClosePrinter
advapi32
RevertToSelf
SystemFunction040
LogonUserW
ImpersonateLoggedOnUser
SystemFunction041
kernel32
QueryPerformanceCounter
LocalFree
LocalAlloc
GetLastError
CloseHandle
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SystemTimeToTzSpecificLocalTime
CompareStringW
InterlockedDecrement
InterlockedIncrement
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
EnterCriticalSection
LoadLibraryW
LeaveCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetSystemTime
FormatMessageW
FileTimeToDosDateTime
DosDateTimeToFileTime
GetProcAddress
user32
wsprintfW
oleaut32
SafeArrayGetUBound
VariantInit
SafeArrayPutElement
VariantTimeToDosDateTime
SafeArrayGetLBound
SafeArrayGetElement
DosDateTimeToVariantTime
CreateErrorInfo
SysAllocString
SetErrorInfo
DispInvoke
LoadRegTypeLi
DispGetIDsOfNames
VariantCopy
SysFreeString
SafeArrayDestroy
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayCreate
VariantClear
secur32
LsaCallAuthenticationPackage
LsaLookupAuthenticationPackage
LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaFreeReturnBuffer
ntdll
RtlInitString
RtlInitUnicodeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ