nianite.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e2729ff25fed760f4cd78ef349606b5c_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e2729ff25fed760f4cd78ef349606b5c_JaffaCakes118.dll
Resource
win10v2004-20240319-en
General
-
Target
e2729ff25fed760f4cd78ef349606b5c_JaffaCakes118
-
Size
91KB
-
MD5
e2729ff25fed760f4cd78ef349606b5c
-
SHA1
565c7152dd2b1bd1f6319abbcbc4f0624a07acff
-
SHA256
6990e42e42e57ebf4674aed87f7e4fbb2ad45ff3e396a41d155fed1506acb5c1
-
SHA512
386bb8b124179d8024ba535fbbd17f4090b748208e906159475b0af47d724cb8603e06c26f581f7543fcfee45ca72d8ad1bd2b80281b981b5e228993dec9d098
-
SSDEEP
1536:XvGCXMTo5stP0//d3eDSfMnABERdspwHZWen00T7V9P2D:Xv7i2gPqCSUnABERdspwHn009P2D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2729ff25fed760f4cd78ef349606b5c_JaffaCakes118
Files
-
e2729ff25fed760f4cd78ef349606b5c_JaffaCakes118.dll windows:4 windows x86 arch:x86
b088e68ff02f60963ed13fdd1842697b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FreeEnvironmentStringsA
LeaveCriticalSection
SetLastError
GetCurrentThreadId
ConnectNamedPipe
WaitForMultipleObjects
HeapAlloc
LCMapStringA
IsBadReadPtr
GetVersionExA
InitializeCriticalSection
ResetEvent
lstrcatW
HeapFree
GetSystemInfo
DeleteCriticalSection
WaitForSingleObject
DuplicateHandle
GetStdHandle
EnterCriticalSection
GetLocaleInfoA
LoadLibraryA
GetLastError
GetCPInfo
IsBadCodePtr
CreateTimerQueueTimer
GetOEMCP
WriteFile
GetModuleHandleA
SetUnhandledExceptionFilter
QueryPerformanceCounter
UnhandledExceptionFilter
GetStartupInfoA
GetEnvironmentStringsW
CreateNamedPipeA
GetACP
OpenProcess
SetEvent
ReleaseMutex
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchangeAdd
WideCharToMultiByte
GetTickCount
UnmapViewOfFile
RtlUnwind
FreeEnvironmentStringsW
InterlockedExchange
MultiByteToWideChar
HeapDestroy
GetEnvironmentStrings
GetFileType
InterlockedCompareExchange
IsBadWritePtr
lstrcpyW
InterlockedDecrement
CreateMutexW
GetModuleFileNameA
LCMapStringW
GetBinaryTypeA
DisconnectNamedPipe
TerminateProcess
CreateEventA
DeleteTimerQueueTimer
user32
wsprintfW
LoadIconA
DrawIcon
CreateIconFromResource
advapi32
InitializeSecurityDescriptor
GetUserNameA
SetSecurityDescriptorDacl
msvcrt
_stricmp
_wtoi
_wcsnset
fflush
vwprintf
_strnicmp
memset
towupper
wcstol
wcsstr
_ltow
wcscmp
printf
wcstod
strtok
wprintf
calloc
memcpy
wcscpy
wcslen
realloc
fprintf
wcscat
fgetws
wcsncmp
malloc
memmove
wcschr
isdigit
swprintf
scanf
free
wcstok
exit
Exports
Exports
boncr
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 774B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ