custsat.pdb
Static task
static1
Behavioral task
behavioral1
Sample
391d43d8665e324f07aa1ccfb1d64df4_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
391d43d8665e324f07aa1ccfb1d64df4_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
391d43d8665e324f07aa1ccfb1d64df4_JaffaCakes118
-
Size
89KB
-
MD5
391d43d8665e324f07aa1ccfb1d64df4
-
SHA1
09632420278c3608d548cab7530b96cdf5ebb997
-
SHA256
fdfb18e1dd9faf54fd407437bc0ea9bd3fa2b20dfacd6aaee115fb96a4cf53c4
-
SHA512
91a35931269f91c56e6f7ad40080dd47ad1e6f9298b5e0969ad471d84c75ea7f571bea21ae9606684631d367949a0300ee6d54f9d25739bad03b161c707be800
-
SSDEEP
1536:HMdsvODmgKLSAztppJLqQT4J8SnYYolHHn8+2fJ977c0YqZ40Q7R3H:zvODmnSAztppJWQs3YYolHHqRVc0YqgX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 391d43d8665e324f07aa1ccfb1d64df4_JaffaCakes118
Files
-
391d43d8665e324f07aa1ccfb1d64df4_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
e4525326eeb953a2976ed938af8e353f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
??3@YAXPAX@Z
_ftol
ceil
??2@YAPAXI@Z
free
realloc
_except_handler3
advapi32
RegCloseKey
shlwapi
SHSetValueW
PathFindFileNameW
wnsprintfW
PathFileExistsW
wnsprintfA
SHStrDupW
SHGetValueW
StrCpyNW
ole32
CreateBindCtx
StringFromGUID2
CoCreateGuid
CreateStreamOnHGlobal
oleaut32
SysAllocString
SysFreeString
kernel32
GetSystemInfo
CreateEventA
LocalAlloc
InterlockedCompareExchange
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateFileMappingA
LocalReAlloc
LeaveCriticalSection
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetLastError
GetVersion
VirtualQuery
FlushInstructionCache
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
FreeLibrary
InterlockedExchange
CompareStringA
FindClose
ResetEvent
DisableThreadLibraryCalls
LoadLibraryA
IsBadWritePtr
IsBadCodePtr
IsBadReadPtr
GetVersionExA
LocalFree
GetLastError
GetSystemTimeAsFileTime
CloseHandle
SystemTimeToFileTime
GetCurrentProcess
CompareFileTime
UnmapViewOfFile
GetSystemTime
MapViewOfFile
GetTickCount
InterlockedIncrement
SetEvent
EnterCriticalSection
WaitForSingleObject
VirtualAlloc
WriteFile
GlobalFree
ReadFile
GlobalAlloc
GetFileSize
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ