d:\Project\publish\prj\HanPubSystem\bin\HanReportForClient.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0563e5ff3a3f75ff48a2f74ae24f64cd_JaffaCakes118.dll
Resource
win7-20240215-en
General
-
Target
0563e5ff3a3f75ff48a2f74ae24f64cd_JaffaCakes118
-
Size
184KB
-
MD5
0563e5ff3a3f75ff48a2f74ae24f64cd
-
SHA1
3f796161254bf225d6ecf0631c14e58c810229b2
-
SHA256
68e7038e1a8fcecc0b05365dff672326aa288e65a5a53f91e6d9e55fa44098ab
-
SHA512
633a6ba57c414878b8c4f7f503c565e54c5f2904bce05057fc192542786f94a028122c482ed5371381584478d6abdc4276aab5be3e34018d9d3079a3f95e1c11
-
SSDEEP
3072:jqwlukw9hp9h5PEEDf3VlkTraJaS+iuZ1HbWl9VT1Hf:pahp75PtCJFKT1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 0563e5ff3a3f75ff48a2f74ae24f64cd_JaffaCakes118
Files
-
0563e5ff3a3f75ff48a2f74ae24f64cd_JaffaCakes118.dll windows:4 windows x86 arch:x86
455522071accae0b5efa955fd14f01c2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetSystemDirectoryA
CloseHandle
OutputDebugStringA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileA
DeleteFileA
WriteFile
GetCurrentThread
ReadFile
SetUnhandledExceptionFilter
FileTimeToSystemTime
GetFileAttributesExA
GetModuleFileNameA
GetLastError
GetTickCount
SetThreadPriority
CreateThread
Module32First
CreateToolhelp32Snapshot
Module32Next
GetFileSize
FlushFileBuffers
GetSystemInfo
VirtualProtect
SetStdHandle
LCMapStringW
LCMapStringA
GetLocaleInfoA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
RtlUnwind
RaiseException
ExitProcess
GetCommandLineA
GetVersionExA
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
TerminateProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
HeapReAlloc
HeapSize
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
GetCPInfo
LoadLibraryA
InterlockedExchange
VirtualQuery
InitializeCriticalSection
SetFilePointer
user32
MessageBoxA
dbghelp
EnumerateLoadedModules
MiniDumpWriteDump
StackWalk
wininet
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
HttpQueryInfoA
InternetReadFile
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetQueryDataAvailable
imagehlp
CheckSumMappedFile
Exports
Exports
?HanReportGetNationCode@@YGHPADPAH@Z
?HanReportGetServiceTypeCode@@YGHPADPAH@Z
?HanReportGetSiteCode@@YGHPADPAH@Z
?HanReportInit@@YGHPAD@Z
?HanReportInit@@YGHPADH@Z
?HanReportInit@@YGHPADH_N@Z
?HanReportInit@@YGHPAD_N@Z
?HanReportSend@@YGHPAD0@Z
?HanReportSend@@YGHPAD@Z
Sections
.text Size: 80KB - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rmnet Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE