c:\281\Some\542_Eat\over\alw\War.pdb
Static task
static1
Behavioral task
behavioral1
Sample
56db3a3d821571d2ee55a37824e78896_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
56db3a3d821571d2ee55a37824e78896_JaffaCakes118
-
Size
852KB
-
MD5
56db3a3d821571d2ee55a37824e78896
-
SHA1
a53fafe32eacf628899ec6caf8e2c488d66f7846
-
SHA256
39f00a78915b3b67d8e4429749efa2fd08e7f633d586dd18a90e809713cd12c9
-
SHA512
da8195153f263674e15d69ba828f89c3e4cc47253889971efd69e2db50e75ac76ea5de0f9faeccaffc578adb9a994388e916548cf2598a6bd33dc19444bda063
-
SSDEEP
24576:rL8cabX4zXsvdilerHJl6N0H1E2C8Nl4Z:3ybX4XslKCe0H1E2C8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 56db3a3d821571d2ee55a37824e78896_JaffaCakes118
Files
-
56db3a3d821571d2ee55a37824e78896_JaffaCakes118.dll windows:6 windows x86 arch:x86
cad3d3dbb9f2581e8e06760908394b82
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
VirtualProtect
WaitForSingleObject
OpenMutexW
LoadLibraryW
CreateProcessW
GetSystemDirectoryW
SetFileAttributesW
SetConsoleOutputCP
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
OutputDebugStringW
GetStringTypeW
HeapReAlloc
LoadLibraryExW
FreeLibrary
GetModuleFileNameW
WriteFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
CreateSemaphoreW
GetModuleHandleW
GetTickCount
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetCommandLineA
GetCurrentThreadId
IsProcessorFeaturePresent
GetLastError
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThread
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FatalAppExitA
GetProcessHeap
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateFileW
ole32
StgCreateDocfile
OleSetContainedObject
OleInitialize
OleCreate
CoSuspendClassObjects
CoInitialize
CoUninitialize
OleUninitialize
winspool.drv
SetPrinterDataExW
SetPortW
FindClosePrinterChangeNotification
SetFormW
ResetPrinterW
ScheduleJob
OpenPrinterW
GetPrinterW
SetJobW
ReadPrinter
SetPrinterDataW
PrinterMessageBoxW
GetPrinterDriverW
EnumPrinterDriversW
EnumPrinterKeyW
EnumPrintersW
Exports
Exports
Jobhelp
Same
ThanShore
Sections
.text Size: 652KB - Virtual size: 652KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 69KB - Virtual size: 686KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ