c:\339\Soon_Back\Hope\Wing\Subject-sentence\Over.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118
-
Size
833KB
-
MD5
3ddb39b2274cac8767d7b30330b5e392
-
SHA1
e7c29e9b9109056647293df1b0bb040937352726
-
SHA256
ecd8bef42e95c6569eba5e866f74a7e97ae2d64445042d26f731158722b05070
-
SHA512
102ebb5fd26743dae06d7e74d5ab1d216147004361e9fe654bf4333b4fa5551205a3429453684ba04d7a79385d23c5290999e3a77afbf8b6d053df83641923c7
-
SSDEEP
24576:nU/lh7rH/i9rz+hwKzyUj/JGzwMgtx1EWsrbw4iaZ4gRrb0:nU9h7e9rz+t/JGz5g3uWsrbw4iaqgRro
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118
Files
-
3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll windows:6 windows x86 arch:x86
8c0d0671247235019d5724ca3b739bf7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FreeLibrary
GetProcAddress
GetVersion
VirtualProtectEx
GetProcessHeap
Sleep
GetLocalTime
OpenMutexW
CreateEventW
LoadLibraryW
GetEnvironmentVariableW
CreateFileW
WaitForSingleObjectEx
OutputDebugStringW
OutputDebugStringA
CloseHandle
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
HeapSize
SetStdHandle
SetEnvironmentVariableW
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
MultiByteToWideChar
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
GetCurrentThread
HeapFree
HeapAlloc
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetStdHandle
GetFileType
SetConsoleCtrlHandler
GetTimeZoneInformation
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CreateThread
ole32
OleUninitialize
OleInitialize
mprapi
MprAdminMIBEntryGetNext
MprConfigInterfaceTransportGetInfo
MprConfigServerBackup
MprConfigInterfaceTransportGetHandle
MprAdminMIBEntrySet
MprConfigInterfaceTransportSetInfo
MprConfigInterfaceTransportRemove
MprConfigInterfaceTransportEnum
Exports
Exports
Dropleave
GlassExercise
Mehope
Top
Sections
.text Size: 507KB - Virtual size: 507KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 284KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 649KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ