e:\__Working\_ezclick\ezweb\Release\MyHelper2.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e8ba6945fdcf0239135d36c97d82283c_JaffaCakes118.dll
Resource
win7-20240220-en
General
-
Target
e8ba6945fdcf0239135d36c97d82283c_JaffaCakes118
-
Size
212KB
-
MD5
e8ba6945fdcf0239135d36c97d82283c
-
SHA1
45055a0666be03a426e05da4e173547abeb0f144
-
SHA256
9e15d2bb411d11d52208008ac6df9d50e8d1a3cc983a79c3700b67a626c56329
-
SHA512
2304ca7975e7ecda98a9943091f08a6ce5894d40b3443fcf946e0ede60f8aff676038dab06ca6de65267f5301f688421ecb803ef096cd2a85027ac052756248e
-
SSDEEP
3072:SbsnnuMExQpyZS+ktBhbGfRD9aOJi/wtKIBA+53xPNjlKHBAu:6sAPEGCN/wEyPNshF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e8ba6945fdcf0239135d36c97d82283c_JaffaCakes118
Files
-
e8ba6945fdcf0239135d36c97d82283c_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
231ce8100b524c99deab5657ce10274d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ws2_32
closesocket
send
inet_ntoa
gethostbyname
gethostname
connect
ioctlsocket
recv
WSACleanup
WSAStartup
WSAGetLastError
socket
inet_addr
htons
kernel32
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrlenA
lstrcmpiA
lstrcpynA
lstrcpyA
GetModuleFileNameA
lstrcatA
IsDBCSLeadByte
InterlockedIncrement
InterlockedDecrement
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
LockResource
FindResourceExA
LocalAlloc
FormatMessageA
LocalFree
CloseHandle
Process32Next
CreateToolhelp32Snapshot
WriteFile
SetFilePointer
CreateFileA
DeleteFileA
CopyFileA
GetFileAttributesExA
GetSystemDirectoryA
GetLocalTime
SleepEx
GetCommandLineA
GetSystemTime
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetStringTypeW
QueryPerformanceCounter
SetStdHandle
FlushFileBuffers
GetTickCount
GetCurrentProcessId
Process32First
GetStringTypeA
LCMapStringW
LCMapStringA
GetCPInfo
GetOEMCP
TlsGetValue
TlsSetValue
TlsFree
GetCurrentProcess
TerminateProcess
GetProcAddress
IsBadWritePtr
VirtualFree
HeapCreate
GetCurrentThreadId
ExitProcess
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
SetLastError
TlsAlloc
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
user32
CharNextA
GetParent
MessageBoxA
wsprintfA
GetWindowThreadProcessId
GetWindowTextA
EnumWindows
advapi32
RegDeleteValueA
RegCreateKeyA
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
ole32
StringFromCLSID
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
shell32
SHGetFileInfoA
oleaut32
SysStringLen
LoadRegTypeLi
VariantChangeType
SysAllocStringLen
VariantClear
VariantInit
VariantCopy
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
GetErrorInfo
shlwapi
PathFindExtensionA
PathFindFileNameA
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 148KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ