c:\Documents and Settings\jaan\Desktop\CustomUninstall\CustomMSI.FullUninstall\Release\CustomMSI.FullUninstall.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3c6b7bdc5932f6d411ecee53d46fa60a_JaffaCakes118.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3c6b7bdc5932f6d411ecee53d46fa60a_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
3c6b7bdc5932f6d411ecee53d46fa60a_JaffaCakes118
-
Size
116KB
-
MD5
3c6b7bdc5932f6d411ecee53d46fa60a
-
SHA1
10d656d09a9b4678de1229cedf273370a851acb3
-
SHA256
63d2c6cb7cc0740c97eac72cfd38cbeea80e9bdaa3c9de403220a0c392de4411
-
SHA512
15cb4c936f06a9fdd029570b1b51fbead0a42e97eb6a8aaf9abeaaaff33313e0ddf21b77e64bc8a9a3fdd742eb14119d36bb52f8fd97ca6f1270abe063e8d41e
-
SSDEEP
1536:24MRKHjXpm52V+XlGkRCGce3h0KoWydlAfrAo6GSAmoLlvyUzCOrEo0kwlHEPXx+:2XMjXU52VGoGXqlKU4zWto07lHEvxy1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c6b7bdc5932f6d411ecee53d46fa60a_JaffaCakes118
Files
-
3c6b7bdc5932f6d411ecee53d46fa60a_JaffaCakes118.dll windows:4 windows x86 arch:x86
694fea38a7adac438ec93898aa4196a5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msi
ord73
kernel32
FindNextFileA
DeleteFileA
GetLastError
FindClose
CreateFileA
FindFirstFileA
RemoveDirectoryA
QueryPerformanceCounter
GetLocaleInfoW
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
ExitProcess
SetFileAttributesA
GetFileAttributesA
HeapFree
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapAlloc
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetCPInfo
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
SetUnhandledExceptionFilter
SetEndOfFile
GetTickCount
GetCurrentProcessId
GetModuleFileNameA
HeapReAlloc
TerminateProcess
GetCurrentProcess
HeapSize
GetACP
GetOEMCP
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
WriteFile
FlushFileBuffers
SetFilePointer
CloseHandle
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
IsBadReadPtr
IsBadCodePtr
LoadLibraryA
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetStdHandle
ReadFile
advapi32
RegDeleteKeyA
shell32
SHGetFolderPathA
Exports
Exports
Uninstall
Sections
.text Size: 80KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ