d:\产品\NewCode\2wow\wow\release\MWDL.pdb
Behavioral task
behavioral1
Sample
f4ee03cb85c6132613abf6b7119090fd_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f4ee03cb85c6132613abf6b7119090fd_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
f4ee03cb85c6132613abf6b7119090fd_JaffaCakes118
-
Size
66KB
-
MD5
f4ee03cb85c6132613abf6b7119090fd
-
SHA1
1207ef5a11a579ed549c4cdbfc6d12851bed8233
-
SHA256
bdddc7aee8101ab033f4b5adfa11c026b64c0ade3e93b9dbf7f7e5ac838dd4bc
-
SHA512
e3e6957ec2868f21b3d665e888d22ce9cacef37f72d9b05b661739a17283ac215b7bbd19a80abf83a6af7dcf996519bf70d38bfa2da1d022778548c1c1522710
-
SSDEEP
768:PJG3Mh+XdwLJuv6w6vUQ6rwKE9sKphof1FN6QV0Ck3zPNCSTKcQ0G2It70ZkHHs4:PiwKE9scBhfjPcV0G2IFc8Hs2/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f4ee03cb85c6132613abf6b7119090fd_JaffaCakes118
Files
-
f4ee03cb85c6132613abf6b7119090fd_JaffaCakes118.dll windows:4 windows x86 arch:x86
c526c2fa037865faec99be3c26118f40
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
lstrcpynA
CreateFileA
ReadFile
GetFileSize
CloseHandle
GetTempPathA
DeleteFileA
MultiByteToWideChar
GlobalAlloc
GlobalLock
WriteFile
GlobalUnlock
GlobalFree
CreateToolhelp32Snapshot
Process32First
GetTickCount
VirtualAlloc
GetModuleHandleA
GetPrivateProfileStringA
CreateThread
WideCharToMultiByte
GetSystemTime
WritePrivateProfileStringA
GetModuleFileNameA
SetFilePointer
CreateMutexA
GetLastError
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
lstrcmpiA
lstrlenA
ExitProcess
lstrcmpA
Sleep
VirtualProtect
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcatA
GetSystemDirectoryA
Process32Next
OutputDebugStringA
user32
PostThreadMessageA
SetWindowsHookExA
CallNextHookEx
GetSystemMetrics
GetDC
ReleaseDC
IsRectEmpty
GetWindowTextA
IsWindowVisible
IsIconic
GetActiveWindow
ShowWindow
SetForegroundWindow
FindWindowA
FindWindowExA
GetWindowThreadProcessId
GetWindowInfo
EnumWindows
PrintWindow
gdi32
CreateCompatibleDC
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
GetObjectA
CreateDCA
GetDeviceCaps
DeleteDC
GetStockObject
SelectPalette
RealizePalette
GetDIBits
ws2_32
gethostbyname
inet_ntoa
gdiplus
GdipSaveImageToFile
GdipCloneImage
GdipGetImageEncoders
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusStartup
GdipLoadImageFromFile
GdiplusShutdown
GdipGetImageEncodersSize
wininet
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
HttpEndRequestA
InternetCloseHandle
msvcrt
??2@YAPAXI@Z
??3@YAXPAX@Z
atoi
malloc
free
memmove
strrchr
strstr
sprintf
??1type_info@@UAE@XZ
memset
memcpy
_except_handler3
_local_unwind2
Exports
Exports
DeleteSelf
HHHH
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
UUUU
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ