Y:\Mars\Release\Header2.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f94c6d821474a786a399fce519523903_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f94c6d821474a786a399fce519523903_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f94c6d821474a786a399fce519523903_JaffaCakes118
-
Size
106KB
-
MD5
f94c6d821474a786a399fce519523903
-
SHA1
f2769ff6df2bf0b121de7be3dc1a5ba1842ae421
-
SHA256
860208c2ded4ab4bc176315fb654c7978b42479d2ed3c0656c5651ca23dc7752
-
SHA512
33384e692c09af5b5b208ed707196848ff32f036239342fff2248102f20a7417450c07221df13cc6253994e1a8e04b69da2fed1727a9b2dafa945792390e9f30
-
SSDEEP
1536:dWqLFKtSZJJg2pSFKSZaifVWG0cYgv7kk9FnzwlVLsOhmL9y1:VLSSZJJg2AFhlx0jlZsomL9y1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f94c6d821474a786a399fce519523903_JaffaCakes118
Files
-
f94c6d821474a786a399fce519523903_JaffaCakes118.dll windows:5 windows x86 arch:x86
83555b4873cebcd50ebe80b3f3c918ef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
SetFilePointer
WriteFile
FlushFileBuffers
GetFileSize
lstrcatA
GetTickCount
LoadLibraryA
GetProcAddress
FreeLibrary
VirtualAlloc
lstrcmpiA
ReadFile
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateDirectoryA
SetFileAttributesA
FindFirstFileA
GetLastError
FindNextFileA
FindClose
GetFileAttributesA
CompareStringW
CreateFileW
CreateFileA
lstrcpyA
DeleteFileA
GetTempPathA
GetModuleFileNameA
GetPrivateProfileStringA
GetSystemDirectoryA
Sleep
GetPrivateProfileIntA
GetCurrentProcess
SetErrorMode
lstrcpynA
lstrlenA
ExitProcess
VirtualFree
WideCharToMultiByte
GetStringTypeW
LCMapStringW
MultiByteToWideChar
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
HeapReAlloc
SetEnvironmentVariableA
RtlUnwind
IsValidCodePage
GetOEMCP
HeapAlloc
HeapFree
ExitThread
GetCurrentThreadId
CreateThread
GetSystemTimeAsFileTime
DecodePointer
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
EncodePointer
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetTimeZoneInformation
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
LoadLibraryW
HeapSize
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
user32
wsprintfA
advapi32
CryptGetHashParam
CryptVerifySignatureA
CryptImportKey
CryptReleaseContext
CryptDestroyHash
CryptDestroyKey
CryptDecrypt
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextA
RegCloseKey
RegOpenKeyExW
RegEnumValueA
shell32
SHCreateDirectoryExA
ws2_32
socket
connect
WSAStartup
closesocket
gethostbyname
recv
send
htons
shlwapi
PathRemoveFileSpecA
StrStrA
StrStrIA
Exports
Exports
OnInject
ServiceMain
start
Sections
.text Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ