D:\haokanbar4\browser\ie\Scan\Release\Scan.pdb
Static task
static1
Behavioral task
behavioral1
Sample
065f9de874ca386a578df94fa000017c_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
065f9de874ca386a578df94fa000017c_JaffaCakes118.dll
Resource
win10v2004-20240419-en
General
-
Target
065f9de874ca386a578df94fa000017c_JaffaCakes118
-
Size
1.2MB
-
MD5
065f9de874ca386a578df94fa000017c
-
SHA1
d59779e9651942a410ad79e0823a3658cda24466
-
SHA256
5bf0e00dc589b4464f78c105b016060424a245f0ee6b94f6af8f3f0f053c07ee
-
SHA512
076a240600b118bf98a664fa7d3cabeda9efb8b91d5a78c23ee9e00d86a1927d55cc43da0f0831199f631ef1e0213109cce05e31155163203b4327b9c689c972
-
SSDEEP
24576:SgcIwdCFEXGwz6Ff78H8KZ7SI7ErlB6azPTkkkkkkkkkkkkkkUkkkkkkkkkkkkkD:SgcIwi5nQ24EreytZ2c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 065f9de874ca386a578df94fa000017c_JaffaCakes118
Files
-
065f9de874ca386a578df94fa000017c_JaffaCakes118.dll windows:5 windows x86 arch:x86
cebe3e34ceb35941b3c83de27fd8e026
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
winmm
timeGetTime
timeBeginPeriod
timeEndPeriod
kernel32
GetFileAttributesExW
DeleteFileW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateMutexW
SetFilePointer
WaitForSingleObject
GetTickCount
GetModuleFileNameW
GetCurrentThreadId
OutputDebugStringA
ReleaseMutex
GetCurrentProcessId
Sleep
RaiseException
InterlockedExchangeAdd
WideCharToMultiByte
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentProcess
GetFullPathNameA
CreateFileA
GetFileSize
FreeLibrary
UnlockFile
LockFile
FormatMessageA
LoadLibraryW
FlushFileBuffers
GetProcAddress
LockFileEx
LoadLibraryA
GetVersionExA
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
InterlockedIncrement
InitializeCriticalSection
InterlockedDecrement
GetThreadLocale
GetACP
GetLocaleInfoA
GetLocaleInfoW
GetTimeZoneInformation
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetConsoleOutputCP
WriteConsoleW
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetModuleHandleA
GetLastError
GetTempPathW
CreateFileW
ReadFile
GetFileAttributesW
WriteFile
GetFullPathNameW
CloseHandle
IsDebuggerPresent
InterlockedExchange
InterlockedCompareExchange
MultiByteToWideChar
GetFileAttributesA
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
GetConsoleMode
GetConsoleCP
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
HeapAlloc
GetCommandLineA
HeapReAlloc
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetStdHandle
GetModuleFileNameA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
ExitProcess
HeapSize
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
shell32
SHFileOperationW
Exports
Exports
InitEngine
ScanLink
Sections
.text Size: 757KB - Virtual size: 756KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 370KB - Virtual size: 370KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ