c:\Plural_before\when\before\Fell.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0409e898d181659e1c4be6f5c9611906_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
0409e898d181659e1c4be6f5c9611906_JaffaCakes118
-
Size
823KB
-
MD5
0409e898d181659e1c4be6f5c9611906
-
SHA1
4b528abaa5d5101eff071a6d3c81229dc3b37fe3
-
SHA256
1b740347452abb85ca6d909d8599ef710d02198c16eceb44a39d4aa111aa9566
-
SHA512
baf3086229ddecd2354b653736c01171cd1fad449125e622b086025a56e85c939fe3dc1b06b415d8bc644736144bb4f5859f48f3d9a9d75b06e31932867129a3
-
SSDEEP
12288:X0y8ZOB93YJh6kwi4eYHc+12GPUhW1brsZaesX/OkSAIV5TQi/c+FI2PXmkp5:X0yMQFViB7IOkesPIVVZQi/csIbk/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 0409e898d181659e1c4be6f5c9611906_JaffaCakes118
Files
-
0409e898d181659e1c4be6f5c9611906_JaffaCakes118.dll windows:6 windows x86 arch:x86
6d01a1ab33bdbff29cf983b7f3c37c4c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleMode
SetFilePointerEx
CloseHandle
WriteConsoleW
DecodePointer
CopyFileW
FileTimeToLocalFileTime
ResetEvent
CreateEventW
GetVersion
FindFirstChangeNotificationW
GetStdHandle
GetFileType
FreeEnvironmentStringsW
GetConsoleCP
GetSystemDirectoryW
GetTempPathW
GetModuleFileNameW
VirtualAlloc
VirtualFree
VirtualProtect
GetProcessHeap
CreateDirectoryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
CreateFileW
user32
GetCursorPos
GetClassInfoExW
GetKeyNameTextW
AppendMenuW
MapDialogRect
GetWindowTextLengthW
GetMessageW
CallWindowProcW
GetFocus
EndDialog
RegisterClassExW
OffsetRect
CloseClipboard
SetFocus
LoadIconW
gdi32
RestoreDC
ExtTextOutW
Rectangle
SaveDC
CreateFontIndirectW
EndPage
StartDocW
ole32
CoTaskMemAlloc
CoUninitialize
CoTaskMemFree
CoRevokeClassObject
CoInitialize
advapi32
SetServiceStatus
RegQueryValueExW
RegOpenKeyW
OpenThreadToken
OpenServiceW
StartServiceCtrlDispatcherW
RegOpenKeyExW
InitializeSecurityDescriptor
LookupPrivilegeValueW
SetSecurityDescriptorDacl
RegCloseKey
RegEnumKeyW
QueryServiceStatus
OpenSCManagerW
RegDeleteKeyW
AllocateAndInitializeSid
GetTokenInformation
SetEntriesInAclW
RegCreateKeyExW
DeleteService
RegisterServiceCtrlHandlerW
RegSetValueExW
OpenProcessToken
FreeSid
comdlg32
ReplaceTextW
GetSaveFileNameW
ChooseFontW
GetOpenFileNameW
comctl32
ImageList_Add
CreateStatusWindowW
ImageList_SetOverlayImage
ord17
ImageList_LoadImageW
CreateToolbarEx
DestroyPropertySheetPage
Exports
Exports
Casetrack
Suffixduck
Summersection
Sections
.text Size: 418KB - Virtual size: 417KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 396KB - Virtual size: 395KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ