adsmsext.pdb
Static task
static1
Behavioral task
behavioral1
Sample
52dc479c8ad10fc6491211bc8321a584_JaffaCakes118.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
52dc479c8ad10fc6491211bc8321a584_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
52dc479c8ad10fc6491211bc8321a584_JaffaCakes118
-
Size
67KB
-
MD5
52dc479c8ad10fc6491211bc8321a584
-
SHA1
7d7f7806ce54f719f04e70daeb9cc672f9872ea2
-
SHA256
7436ca3a5320fc66060651662f4127663218e0287208c9d9fe072798a4f2eeba
-
SHA512
603e90d69c6eb31ea04ee710882656e922fd9a9d765daee445b88fbb024b2f8a68e50af0c37b04bb66d3f7f74ca7d885078c9a69fc7114e18acd4921ab1dc6b8
-
SSDEEP
1536:kyn0E5iA3qsmKkMawmG6E33i2+fJTvVYL4Yd:kyn/5p3mKkMawmG67TNYL4c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52dc479c8ad10fc6491211bc8321a584_JaffaCakes118
Files
-
52dc479c8ad10fc6491211bc8321a584_JaffaCakes118.dll windows:5 windows x86 arch:x86
5a5cd7a1eec692421a9c35582f680ec9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_except_handler3
_adjust_fdiv
malloc
_initterm
free
_wcsnicmp
_purecall
wcscat
wcscpy
wcslen
wcstok
swscanf
_wcsicmp
wcscmp
sprintf
wcschr
activeds
ord7
ord15
ord17
ord18
ord9
ord16
ord3
ord14
adsldpc
ADsObject
ReadServerSupportsIsADControl
LdapGetSyntaxOfAttributeOnServer
FreeObjectInfo
LdapCompareExt
ChangeSeparator
BuildADsPathFromLDAPPath
LdapReadAttributeFast
LdapValueFree
BuildLDAPPathFromADsPath2
GetDefaultServer
LdapCrackUserDNtoNTLMUser
LdapCrackUserDNtoNTLMUser2
LdapCloseObject
LdapOpenObject
LdapModifyS
wldap32
ord12
netapi32
NetUserSetInfo
NetUserChangePassword
ole32
CoCreateInstance
winspool.drv
SetPrinterW
OpenPrinterW
GetPrinterW
ClosePrinter
advapi32
RevertToSelf
SystemFunction040
LogonUserW
ImpersonateLoggedOnUser
SystemFunction041
kernel32
QueryPerformanceCounter
LocalFree
LocalAlloc
GetLastError
CloseHandle
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SystemTimeToTzSpecificLocalTime
CompareStringW
InterlockedDecrement
InterlockedIncrement
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
EnterCriticalSection
LoadLibraryW
LeaveCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetSystemTime
FormatMessageW
FileTimeToDosDateTime
DosDateTimeToFileTime
GetProcAddress
user32
wsprintfW
oleaut32
SafeArrayGetUBound
VariantInit
SafeArrayPutElement
VariantTimeToDosDateTime
SafeArrayGetLBound
SafeArrayGetElement
DosDateTimeToVariantTime
CreateErrorInfo
SysAllocString
SetErrorInfo
DispInvoke
LoadRegTypeLi
DispGetIDsOfNames
VariantCopy
SysFreeString
SafeArrayDestroy
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayCreate
VariantClear
secur32
LsaCallAuthenticationPackage
LsaLookupAuthenticationPackage
LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaFreeReturnBuffer
ntdll
RtlInitString
RtlInitUnicodeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ