c:\wheel\receive\Many-rise\score.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c4c060ec6b1e42d70972d0af66a04e66_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
c4c060ec6b1e42d70972d0af66a04e66_JaffaCakes118
-
Size
701KB
-
MD5
c4c060ec6b1e42d70972d0af66a04e66
-
SHA1
3ef84847fceb31b8814c12c94c57c72a5281d6f5
-
SHA256
47715e425398283d53019c270311ad0c709f660048d2f884d5116d80b983743f
-
SHA512
5553d68867af378d347620208b35d4d6261526770cf2a47884f0eff17392cedfa91ab491265717a459b4ccbe43f490a90caaf9289b9f92e8cd63140710e9ca78
-
SSDEEP
12288:QUAQSxT6fDEr8Np6b/rPPsjosrS9aEoe+0JCym+4YJAOSVUNcuHIGF4uW/XPGAsx:Qz3xT6fq8Np6bTPPaBreaZlYCOSVolam
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c4c060ec6b1e42d70972d0af66a04e66_JaffaCakes118
Files
-
c4c060ec6b1e42d70972d0af66a04e66_JaffaCakes118.dll windows:6 windows x86 arch:x86
8acc1c3be9064cb55c8e3d7147f3d7c3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LockResource
FreeLibrary
GetProcAddress
VirtualProtect
OpenProcess
GetCurrentThreadId
Sleep
GetSystemTime
CreateSemaphoreW
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
GetTempPathW
CreateFileW
GetVolumeInformationW
QueryPerformanceCounter
GetVersionExW
GetDateFormatW
OutputDebugStringW
CloseHandle
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
HeapSize
SetStdHandle
SetFilePointerEx
GetFileSizeEx
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetConsoleCtrlHandler
GetFileType
GetStdHandle
HeapReAlloc
HeapFree
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
MultiByteToWideChar
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
InitializeSListHead
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
LoadLibraryExW
QueryPerformanceFrequency
ExitProcess
GetModuleHandleExW
GetCurrentThread
HeapAlloc
GetTimeZoneInformation
GetTimeFormatW
WriteConsoleW
user32
TranslateMessage
CreateMenu
UnregisterHotKey
DeferWindowPos
RegisterWindowMessageW
BeginDeferWindowPos
GetPropW
msacm32
acmFormatChooseW
acmFilterEnumW
acmFilterTagDetailsW
acmFilterDetailsW
acmDriverClose
acmFormatDetailsW
acmDriverOpen
acmDriverPriority
acmDriverMessage
acmFormatTagEnumW
acmDriverAddW
acmFilterTagEnumW
acmFormatTagDetailsW
acmDriverEnum
acmFormatEnumW
acmDriverID
acmFormatSuggest
acmDriverDetailsW
acmFilterChooseW
acmGetVersion
acmDriverRemove
acmMetrics
Exports
Exports
BeGrass
Fieldeight
Often
Townenter
Sections
.text Size: 488KB - Virtual size: 487KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 185KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ