dpamnlrd.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0cc4d29808e05957526c4893bffd6aeb_JaffaCakes118.dll
Resource
win7-20240220-en
General
-
Target
0cc4d29808e05957526c4893bffd6aeb_JaffaCakes118
-
Size
1.2MB
-
MD5
0cc4d29808e05957526c4893bffd6aeb
-
SHA1
fa50605e089ba9fea19c9fd354ed10f502d67e9c
-
SHA256
b6118f4e271962f340a7db112f550eacd9350522cf18c5cac9254b2529e87a76
-
SHA512
8ec75b8724a5bd3eccdd825c671f0f401a80cef33d745741fdb2b4bced8507ae71b12cf7a7e2e422a540f7c79320a51d3357deb748fc4d9e8ab036732d58a4b1
-
SSDEEP
24576:iVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:iV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 0cc4d29808e05957526c4893bffd6aeb_JaffaCakes118
Files
-
0cc4d29808e05957526c4893bffd6aeb_JaffaCakes118.dll windows:5 windows x64 arch:x64
a23d507241571c69f1f380438b3a251c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
comdlg32
GetFileTitleW
advapi32
DecryptFileW
LookupAccountSidA
DeregisterEventSource
GetSecurityDescriptorSacl
user32
DrawStateW
InsertMenuW
DrawTextA
DrawIconEx
kernel32
GetCurrentThread
GetEnvironmentStringsW
GetThreadId
GetPrivateProfileStringW
FillConsoleOutputCharacterA
GetCommProperties
GetThreadTimes
DebugActiveProcess
GlobalDeleteAtom
lstrcmpiW
VirtualAlloc
GetNLSVersion
GetLastError
LoadLibraryA
ConvertDefaultLocale
DeleteTimerQueueTimer
FreeResource
gdi32
GetTextExtentExPointI
GetViewportOrgEx
GetCharWidthW
GetWindowExtEx
GetSystemPaletteEntries
GetCharWidth32A
DeleteEnhMetaFile
Exports
Exports
GetTapi16CallbackMsg
LAddrParamsInited
LOpenDialAsst
LocWizardDlgProc
MMCAddProvider
MMCConfigProvider
MMCGetAvailableProviders
MMCGetDeviceFlags
MMCGetLineInfo
MMCGetLineStatus
MMCGetPhoneInfo
MMCGetPhoneStatus
MMCGetProviderList
MMCGetServerConfig
MMCInitialize
MMCRemoveProvider
MMCSetLineInfo
MMCSetPhoneInfo
MMCSetServerConfig
MMCShutdown
NonAsyncEventThread
TAPIWndProc
TUISPIDLLCallback
internalConfig
internalCreateDefLocation
internalNewLocationW
internalPerformance
internalRemoveLocation
internalRenameLocationW
lineAccept
lineAddProvider
lineAddProviderA
lineAddProviderW
lineAddToConference
lineAgentSpecific
lineAnswer
lineBlindTransfer
lineBlindTransferA
lineBlindTransferW
lineClose
lineCompleteCall
lineCompleteTransfer
lineConfigDialog
lineConfigDialogA
lineConfigDialogEdit
lineConfigDialogEditA
lineConfigDialogEditW
lineConfigDialogW
lineConfigProvider
lineCreateAgentA
lineCreateAgentSessionA
lineCreateAgentSessionW
lineCreateAgentW
lineDeallocateCall
lineDevSpecific
lineDevSpecificFeature
lineDial
lineDialA
lineDialW
lineDrop
lineForward
lineForwardA
lineForwardW
lineGatherDigits
lineGatherDigitsA
lineGatherDigitsW
lineGenerateDigits
lineGenerateDigitsA
lineGenerateDigitsW
lineGenerateTone
lineGetAddressCaps
lineGetAddressCapsA
lineGetAddressCapsW
lineGetAddressID
lineGetAddressIDA
lineGetAddressIDW
lineGetAddressStatus
lineGetAddressStatusA
lineGetAddressStatusW
lineGetAgentActivityListA
lineGetAgentActivityListW
lineGetAgentCapsA
lineGetAgentCapsW
lineGetAgentGroupListA
lineGetAgentGroupListW
lineGetAgentInfo
lineGetAgentSessionInfo
lineGetAgentSessionList
lineGetAgentStatusA
lineGetAgentStatusW
lineGetAppPriority
lineGetAppPriorityA
lineGetAppPriorityW
lineGetCallInfo
lineGetCallInfoA
lineGetCallInfoW
lineGetCallStatus
lineGetConfRelatedCalls
lineGetCountry
lineGetCountryA
lineGetCountryW
lineGetDevCaps
lineGetDevCapsA
lineGetDevCapsW
lineGetDevConfig
lineGetDevConfigA
lineGetDevConfigW
lineGetGroupListA
lineGetGroupListW
lineGetID
lineGetIDA
lineGetIDW
lineGetIcon
lineGetIconA
lineGetIconW
lineGetLineDevStatus
lineGetLineDevStatusA
lineGetLineDevStatusW
lineGetMessage
lineGetNewCalls
lineGetNumRings
lineGetProviderList
lineGetProviderListA
lineGetProviderListW
lineGetProxyStatus
lineGetQueueInfo
lineGetQueueListA
lineGetQueueListW
lineGetRequest
lineGetRequestA
lineGetRequestW
lineGetStatusMessages
lineGetTranslateCaps
lineGetTranslateCapsA
lineGetTranslateCapsW
lineHandoff
lineHandoffA
lineHandoffW
lineHold
lineInitialize
lineInitializeExA
lineInitializeExW
lineMakeCall
lineMakeCallA
lineMakeCallW
lineMonitorDigits
lineMonitorMedia
lineMonitorTones
lineNegotiateAPIVersion
lineNegotiateExtVersion
lineOpen
lineOpenA
lineOpenW
linePark
lineParkA
lineParkW
linePickup
linePickupA
linePickupW
linePrepareAddToConference
linePrepareAddToConferenceA
linePrepareAddToConferenceW
lineProxyMessage
lineProxyResponse
lineRedirect
lineRedirectA
lineRedirectW
lineRegisterRequestRecipient
lineReleaseUserUserInfo
lineRemoveFromConference
lineRemoveProvider
lineSecureCall
lineSendUserUserInfo
lineSetAgentActivity
lineSetAgentGroup
lineSetAgentMeasurementPeriod
lineSetAgentSessionState
lineSetAgentState
lineSetAgentStateEx
lineSetAppPriority
lineSetAppPriorityA
lineSetAppPriorityW
lineSetAppSpecific
lineSetCallData
lineSetCallParams
lineSetCallPrivilege
lineSetCallQualityOfService
lineSetCallTreatment
lineSetCurrentLocation
lineSetDevConfig
lineSetDevConfigA
lineSetDevConfigW
lineSetLineDevStatus
lineSetMediaControl
lineSetMediaMode
lineSetNumRings
lineSetQueueMeasurementPeriod
lineSetStatusMessages
lineSetTerminal
lineSetTollList
lineSetTollListA
lineSetTollListW
lineSetupConference
lineSetupConferenceA
lineSetupConferenceW
lineSetupTransfer
lineSetupTransferA
lineSetupTransferW
lineShutdown
lineSwapHold
lineTranslateAddress
lineTranslateAddressA
lineTranslateAddressW
lineTranslateDialog
lineTranslateDialogA
lineTranslateDialogW
lineUncompleteCall
lineUnhold
lineUnpark
lineUnparkA
lineUnparkW
phoneClose
phoneConfigDialog
phoneConfigDialogA
phoneConfigDialogW
phoneDevSpecific
phoneGetButtonInfo
phoneGetButtonInfoA
phoneGetButtonInfoW
phoneGetData
phoneGetDevCaps
phoneGetDevCapsA
phoneGetDevCapsW
phoneGetDisplay
phoneGetGain
phoneGetHookSwitch
phoneGetID
phoneGetIDA
phoneGetIDW
phoneGetIcon
phoneGetIconA
phoneGetIconW
phoneGetLamp
phoneGetMessage
phoneGetRing
phoneGetStatus
phoneGetStatusA
phoneGetStatusMessages
phoneGetStatusW
phoneGetVolume
phoneInitialize
phoneInitializeExA
phoneInitializeExW
phoneNegotiateAPIVersion
phoneNegotiateExtVersion
phoneOpen
phoneSetButtonInfo
phoneSetButtonInfoA
phoneSetButtonInfoW
phoneSetData
phoneSetDisplay
phoneSetGain
phoneSetHookSwitch
phoneSetLamp
phoneSetRing
phoneSetStatusMessages
phoneSetVolume
phoneShutdown
tapiGetLocationInfo
tapiGetLocationInfoA
tapiGetLocationInfoW
tapiRequestDrop
tapiRequestMakeCall
tapiRequestMakeCallA
tapiRequestMakeCallW
tapiRequestMediaCall
tapiRequestMediaCallA
tapiRequestMediaCallW
Sections
.text Size: 912KB - Virtual size: 911KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 276KB - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 318B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ