c:\documents and settings\stas\рабочий стол\clinker\clinker\release\CLinker.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ff967e3203b56c16de7151b2b14f52ae_JaffaCakes118.dll
Resource
win7-20240220-en
General
-
Target
ff967e3203b56c16de7151b2b14f52ae_JaffaCakes118
-
Size
140KB
-
MD5
ff967e3203b56c16de7151b2b14f52ae
-
SHA1
f7fa2ebf93e16efb9cbdf9bbd3e07461e19c5fec
-
SHA256
01b02b1d0de804606500fd14bd875e01f29807ce51c49aed4329dc346b31fd62
-
SHA512
ea7ca664451cd1aa53eb4ca74f6defd9e5597d374a2a0d3b08810a196be7ff6ddad59fe37da576062caf3530548c485b2db54656e7a1b7f1f767af62da1a8981
-
SSDEEP
1536:lqTdtFdkq4BXiDFrcAI9zW5kopyNBD2WQJjFYrUJHz9S0/EC/u48VM28XZtxspM:lqTdtk2DVx5koyKwoj/RqVM2ytxCM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff967e3203b56c16de7151b2b14f52ae_JaffaCakes118
Files
-
ff967e3203b56c16de7151b2b14f52ae_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
12c1c8080e54a5893ae81846bd191d12
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SetThreadLocale
DeleteCriticalSection
RaiseException
EnterCriticalSection
InitializeCriticalSection
lstrlenW
GetLastError
GetModuleFileNameW
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrlenA
CreateFileW
GetFileTime
GetSystemTime
SystemTimeToFileTime
CloseHandle
GetThreadLocale
DeleteFileA
SetFileAttributesW
HeapCreate
HeapAlloc
HeapFree
WideCharToMultiByte
GetConsoleOutputCP
WriteConsoleA
ReadFile
FlushFileBuffers
SetStdHandle
CreateFileA
DisableThreadLibraryCalls
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
lstrcmpiW
DeleteFileW
FreeLibrary
SetEndOfFile
LCMapStringW
GetOEMCP
GetCPInfo
LoadLibraryA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
WriteConsoleW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
HeapReAlloc
GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleA
GetSystemInfo
VirtualQuery
GetCurrentThreadId
GetCommandLineA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
HeapDestroy
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
HeapSize
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
GetConsoleCP
user32
SetTimer
IsWindowVisible
KillTimer
CloseWindow
CharNextW
UnregisterClassA
advapi32
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryValueExW
ole32
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
oleaut32
SysStringLen
DispCallFunc
LoadRegTypeLi
VariantInit
VariantClear
SysFreeString
LoadTypeLi
SysAllocString
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
wininet
FindCloseUrlCache
DeleteUrlCacheEntryW
FindFirstUrlCacheEntryW
InternetCloseHandle
InternetReadFile
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW
FindNextUrlCacheEntryW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 92KB - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ