e:\src\rpautostream\rel32\rpautostream.pdb
Static task
static1
Behavioral task
behavioral1
Sample
293cf58212b50df51bdaa72f558b9f23_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
293cf58212b50df51bdaa72f558b9f23_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
293cf58212b50df51bdaa72f558b9f23_JaffaCakes118
-
Size
220KB
-
MD5
293cf58212b50df51bdaa72f558b9f23
-
SHA1
4003809aac48185e69915294523ace99084bd55d
-
SHA256
dfa9b7bafe25801ab6700b14f2f978a1d60faa60f3650e58cab3ba7d1b583538
-
SHA512
42157be8fdb91cd0cba2b86ebfa21b746d7965786e9dce993c712cb6c7cb45c4acfc791e3d8192f1d3b50c582a3413a62703265efb5ef659cf1054ac69aa8249
-
SSDEEP
6144:VM/STOulpWdVBxEuyoSQ5GuD0HJbrCbOh848g:9pl+nxKQklxrZCJg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 293cf58212b50df51bdaa72f558b9f23_JaffaCakes118
Files
-
293cf58212b50df51bdaa72f558b9f23_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
96ea83921b01b7d8e9170676203031cf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ole32
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
kernel32
GetVersionExA
WinExec
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
GetLastError
lstrlenA
lstrcmpiA
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
lstrcpynA
lstrcpyA
GetCurrentThreadId
lstrcatA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
lstrlenW
DeleteCriticalSection
InitializeCriticalSection
RaiseException
WideCharToMultiByte
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
user32
UnhookWindowsHookEx
GetClassNameA
CallNextHookEx
SetWindowsHookExA
wsprintfA
CharNextA
advapi32
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyA
RegQueryValueExA
oleaut32
SysFreeString
SysAllocString
SysStringLen
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
shlwapi
PathFindExtensionA
msvcr71
??_V@YAXPAX@Z
_adjust_fdiv
_initterm
_onexit
__dllonexit
__security_error_handler
memset
??2@YAPAXI@Z
realloc
wcsncpy
_purecall
_resetstkoflw
malloc
sprintf
??_U@YAPAXI@Z
strchr
??3@YAXPAX@Z
free
_except_handler3
__CppXcptFilter
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 172KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ