kavfojajbl.pdb
Static task
static1
Behavioral task
behavioral1
Sample
52b9b8bc9042bee1ff7ddf3b81f59570_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
52b9b8bc9042bee1ff7ddf3b81f59570_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
52b9b8bc9042bee1ff7ddf3b81f59570_JaffaCakes118
-
Size
184KB
-
MD5
52b9b8bc9042bee1ff7ddf3b81f59570
-
SHA1
2db3da9e2008f0b99987e552b63abcb94e3ff569
-
SHA256
2476005925ef2fa47c1d8192d224e60c25bbfc160bb4149f7ea8ee162622dfc3
-
SHA512
0a27ac5e6bf7efd0157653a20eccde67675bd460fce10f205c79e50657ac7f048fbc99a415d7a27bd1074a43e0a8a44850e3fda6d5de283a53e62246a9ec4d22
-
SSDEEP
1536:iy692NdVmFQ8nsllU6JPcbv5CqPJI+n4IMpI5jpXVdnfnrFx0:in27VcnKTEbZPJI84IMpG5TFx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52b9b8bc9042bee1ff7ddf3b81f59570_JaffaCakes118
Files
-
52b9b8bc9042bee1ff7ddf3b81f59570_JaffaCakes118.dll windows:4 windows x86 arch:x86
11910dbbf14789ba4ccc96a641c4cd4e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
ExitProcess
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
RaiseException
LocalReAlloc
LocalAlloc
LocalFree
GetVersion
CloseHandle
GetProcessHeap
HeapFree
HeapAlloc
FormatMessageA
FindResourceA
DeleteCriticalSection
lstrlenA
lstrcpynA
FreeLibrary
LoadResource
InterlockedIncrement
InterlockedDecrement
GetCurrentProcess
GetVersionExA
DebugBreak
SetUnhandledExceptionFilter
WideCharToMultiByte
SizeofResource
HeapDestroy
LeaveCriticalSection
IsDBCSLeadByte
lstrcatA
MultiByteToWideChar
lstrlenW
GetShortPathNameA
GetLastError
IsBadReadPtr
IsBadWritePtr
lstrcpyA
lstrcmpiA
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
DisableThreadLibraryCalls
EnterCriticalSection
GetProcAddress
RtlUnwind
GetLocalTime
GetDateFormatA
CreateEventA
CreateThread
SetEvent
WaitForSingleObject
OutputDebugStringA
InitializeCriticalSection
IsBadCodePtr
user32
CharUpperA
MoveWindow
CharNextA
wsprintfA
advapi32
RegOpenKeyExA
RegDeleteValueA
RegSetValueExA
RegEnumValueA
RegCreateKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegQueryInfoKeyA
ole32
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoCreateInstance
CoInitialize
shlwapi
wnsprintfA
wnsprintfW
StrCmpW
StrCmpIW
Exports
Exports
ErWsI_QKC
Sections
.text Size: 124KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 384KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ