c:\25\42\Should\1\1\Off\Party\44\19\28\age\5\Point\93\thousand.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0704068b7be5426f38f2da38c965d04e_JaffaCakes118.dll
Resource
win7-20240220-en
General
-
Target
0704068b7be5426f38f2da38c965d04e_JaffaCakes118
-
Size
280KB
-
MD5
0704068b7be5426f38f2da38c965d04e
-
SHA1
80ef0434d370a4b112cb632b1868aad93d53a9bd
-
SHA256
8c8896ec10234612dd5063dfa4f84ca815ace19c4c2b0b3def9c29be0029f390
-
SHA512
042f7eb2107965149f7cd249de9adcda4a5367d5a789fa4cc71450332f80c7c1d861653646c57faeebe173ca2371530585f0dd36b9164f46132f0652eaa98808
-
SSDEEP
6144:SqUtrd+yrmjlZI3vIVMPN6SG2H9X0A6NPXiGmJ5WMm:Sz+yoZIwVMPN6SG2x0dNfiGuI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 0704068b7be5426f38f2da38c965d04e_JaffaCakes118
Files
-
0704068b7be5426f38f2da38c965d04e_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
c5de455d81abbc68d1b34bdb0878579d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CreateProcessW
GetCurrentThreadId
RemoveDirectoryW
DeviceIoControl
GetCurrentProcess
Sleep
LoadLibraryW
GetProcAddress
VirtualProtect
GetWindowsDirectoryW
GetCurrentDirectoryW
GetTempPathW
RaiseException
RtlUnwind
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
SetFilePointer
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
CloseHandle
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
CreateFileA
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
ReadFile
SetEndOfFile
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
Exports
Exports
Cornforest
DllRegisterServer
Elsemachine
Grow
Sections
.text Size: 232KB - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ