X:\toolbars\toolbars\jetmp3\code\ie\Release\jetmp3.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3da2c3abc105e40ce5714f25c367d702_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
3da2c3abc105e40ce5714f25c367d702_JaffaCakes118
-
Size
53KB
-
MD5
3da2c3abc105e40ce5714f25c367d702
-
SHA1
78d6f70d03bef42ef1229e1e3536837962e535b2
-
SHA256
5bb1d0f5cfe9f2959ada3679a84d63de14f6c2d43d25d81010dfbb56376547fc
-
SHA512
07fe5e5bb50720dc6fa38d32cc38eba6411b9ffa7a195969833cd7aa3717a995b589e22c6a3821fda1a737e6246819e8f93d8e06c7fd0a883042c1ddbfe7cf12
-
SSDEEP
768:GDfN9wiAxAfgsA83/hL9sWx2grEDcn2BAAzpmaNdl7yX:GDHwiAlypsW5j4rdl7yX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3da2c3abc105e40ce5714f25c367d702_JaffaCakes118
Files
-
3da2c3abc105e40ce5714f25c367d702_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
e4d8fcba52b2c287b1aadcbc1750bd3f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
WideCharToMultiByte
IsBadWritePtr
InterlockedDecrement
DisableThreadLibraryCalls
GetModuleFileNameW
InterlockedIncrement
HeapReAlloc
DecodePointer
EncodePointer
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetLastError
HeapFree
HeapAlloc
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetProcAddress
Sleep
ExitProcess
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
HeapSize
LCMapStringW
MultiByteToWideChar
GetStringTypeW
IsProcessorFeaturePresent
advapi32
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
oleaut32
VariantInit
VariantClear
SysAllocString
SysFreeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ