C:\AtivG5KLS9M5\gNav0PidqR\ixwh\qJ0rU54viv4\V6J27Epwl\WjgrG5Wl\qZ4B0HqVox\ydGHc7EN2l\LIPmB6PKp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e8b44109a8f5a5d094ec27ce92751af5_JaffaCakes118.dll
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
e8b44109a8f5a5d094ec27ce92751af5_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
e8b44109a8f5a5d094ec27ce92751af5_JaffaCakes118
-
Size
1.3MB
-
MD5
e8b44109a8f5a5d094ec27ce92751af5
-
SHA1
d3f3a4df46599d077ff001e2b1f77302dcb4bf54
-
SHA256
70f92b573b46dba751059971227a48b7d8ac6e6abb1bc494521139f5436288ce
-
SHA512
a71d4f13062bc141f967eeccb5e0a4d1c353939fc3d5b10bade260f4114dcab1443b2ff4e569c56b9dc0e36656815f9cafca7c51888c6e0c3677222196f7bec3
-
SSDEEP
12288:5NcCybvhuRSEEucC0yRWa9zH1aqy7a569J1PcW//xuyy7j0pfJtNiC1MraweN8Q6:5O5ZlGDpaqw7EMd0jYEJa5V6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e8b44109a8f5a5d094ec27ce92751af5_JaffaCakes118
Files
-
e8b44109a8f5a5d094ec27ce92751af5_JaffaCakes118.dll windows:6 windows x64 arch:x64
c678968ccf8eae877993f7b0c08c6980
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetACP
GetEnvironmentStringsW
IsDebuggerPresent
AreFileApisANSI
GetLogicalDrives
GetCommandLineW
GetUserDefaultUILanguage
GetLargePageMinimum
IsSystemResumeAutomatic
GetSystemDefaultLangID
GetCommandLineA
GetTickCount64
GetLastError
GetThreadUILanguage
UnregisterApplicationRecoveryCallback
UnregisterApplicationRestart
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
HeapReAlloc
GetCurrentProcessorNumber
GetUserDefaultLangID
HeapSize
GetStringTypeW
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
user32
GetProcessWindowStation
GetCursor
AnyPopup
InSendMessage
GetCapture
GetMenuCheckMarkDimensions
CloseClipboard
EmptyClipboard
CountClipboardFormats
IsProcessDPIAware
GetClipboardSequenceNumber
GetDesktopWindow
gdi32
GdiFlush
ole32
CoUninitialize
Exports
Exports
CnIRSDgVinoJOzgNmbsVSzsZODclqX
FSDYJCHEFWXcROPktCHUharUFCzM
KngFePAderAVuHkpmXwBCXcpGXohu
OnIlmTEdmfI
StartW
SzkdiXYxOPwVa
UBCnUxSbwpSfs
WTcxifwFWfUlqvIhaXcVmTgtqnMtmX
WrYdeXQVCvs
YxWPcFKXcxmfAdiTQJqrcdefUNifEl
ZKfwVWvw
bsZKzAduHMlinAlOPYVibgdaPkFuzg
dqTkZOHwBeTcViTI
hKbwtyjUByzkRGjA
lqfstqXcNmHsNefIlWzwxC
mzUVCnMxarktezY
pSbsVGnAdmropOjopCrMdKzghC
sVeTABGTgxebIdKnItuDMROnwlanAJ
sZKPcxKnEhuvcpGTsVqHcZiTsRmbw
tuLodCPERiXkpCrM
wVCvIpOfkxarUJObQ
Sections
.text Size: 1021KB - Virtual size: 1020KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 319KB - Virtual size: 318KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ