C:\DLL.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2676c1ce43f5f8c520a2c8a25a10b5f3_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2676c1ce43f5f8c520a2c8a25a10b5f3_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
2676c1ce43f5f8c520a2c8a25a10b5f3_JaffaCakes118
-
Size
16KB
-
MD5
2676c1ce43f5f8c520a2c8a25a10b5f3
-
SHA1
1f44795783dda348138e8948c091f7bac417c69a
-
SHA256
c0bfa044f549869b101ff8979ca52c8f3df89b238072d3c9fb37153d0a47b0ee
-
SHA512
ba966daabe44a6adb661c5c5505e923e4db017e79e5af42dee6810b36b01e23b84138caf1982fee24ba003b5be825f5c4251d95aa6865eac0cad1561065dc0f2
-
SSDEEP
192:LR2b+SWEWauNreN1pWFBtsX2GO9RgZI+0QhajD06DPjovaER:10uNre1pWnSmGO7gO+0AajA6DP0v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2676c1ce43f5f8c520a2c8a25a10b5f3_JaffaCakes118
Files
-
2676c1ce43f5f8c520a2c8a25a10b5f3_JaffaCakes118.dll windows:5 windows x86 arch:x86
2ee952f59e8f9dd0c14fd54cbacb9c11
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
strlen
strcpy
sprintf
??2@YAPAXI@Z
strrchr
??3@YAXPAX@Z
memset
shlwapi
SHDeleteKeyA
psapi
GetModuleFileNameExA
kernel32
WaitForSingleObject
OpenProcess
Sleep
CreateProcessA
lstrcmpiA
GetProcAddress
CopyFileA
DeviceIoControl
CreateFileA
GetModuleHandleA
CloseHandle
ResumeThread
DeleteFileA
CreateThread
lstrcpyA
GetFileSize
lstrlenA
ReadFile
ExitProcess
LoadLibraryA
LoadLibraryExA
LocalFree
FreeLibrary
Process32First
WriteFile
lstrcatA
Process32Next
CreateToolhelp32Snapshot
GetModuleFileNameA
GetTempPathA
user32
OpenDesktopA
wsprintfA
SetThreadDesktop
SetProcessWindowStation
OpenWindowStationA
advapi32
RegSetValueExA
SetNamedSecurityInfoA
OpenProcessToken
CreateProcessAsUserA
RegCreateKeyExA
RegOpenKeyExA
BuildExplicitAccessWithNameA
RegCloseKey
OpenSCManagerA
StartServiceA
CreateServiceA
GetNamedSecurityInfoA
CloseServiceHandle
shell32
ShellExecuteExA
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 678B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ