J:\KMS-8\KMSEmulator.NET\Release\KMSWrapper32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3cad010b00c09f3c2e65e72bd1a4aab0_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3cad010b00c09f3c2e65e72bd1a4aab0_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
3cad010b00c09f3c2e65e72bd1a4aab0_JaffaCakes118
-
Size
74KB
-
MD5
3cad010b00c09f3c2e65e72bd1a4aab0
-
SHA1
c4a7690398cf1ae5cfe55192475212e01e578fc1
-
SHA256
24385988922e18f4fe8b74c73181366d70c973b10c7faed686124ad25b316fc3
-
SHA512
1fcde9620e80936edae4bcf093c1bb38777b6b931386ac3b1878c40eacc765e8a5c56002b89bf749715d48d6baedb076866b9352493a82f2c200d119c6cdf95e
-
SSDEEP
1536:IokvLFF/n1FcSPZuYw601UQR27YZf4dq3I:I9vBFzcStkUQR27YZf403I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cad010b00c09f3c2e65e72bd1a4aab0_JaffaCakes118
Files
-
3cad010b00c09f3c2e65e72bd1a4aab0_JaffaCakes118.dll windows:6 windows x86 arch:x86
b771b76a3664eae68b0676a187eaf874
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcr110
__crtUnhandledException
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
memset
rand_s
_itow_s
malloc
memcpy
__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
_initterm_e
_initterm
_malloc_crt
free
_amsg_exit
__crtTerminateProcess
_cexit
__FrameUnwindFilter
kernel32
IsProcessorFeaturePresent
IsDebuggerPresent
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
Sleep
rpcrt4
NdrServerCall2
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcServerRegisterIfEx
advapi32
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptSetKeyParam
CryptAcquireContextW
CryptGetHashParam
mscoree
_CorDllMain
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ