E:\Visual Studio Code\VS\github.com\ssoor\youniverse_helper\Release\Youniverse.pdb
Static task
static1
Behavioral task
behavioral1
Sample
13d21cdb01a2e3111a31487da8e7716e_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
13d21cdb01a2e3111a31487da8e7716e_JaffaCakes118.dll
Resource
win10v2004-20240419-en
General
-
Target
13d21cdb01a2e3111a31487da8e7716e_JaffaCakes118
-
Size
153KB
-
MD5
13d21cdb01a2e3111a31487da8e7716e
-
SHA1
2aab2dac8abaca46048c781dd7346dad2bd64dc3
-
SHA256
ab869fa0e35e6448a7ef6bc6de6213b16da41a398f3babd0dc8f544a9aaa64f0
-
SHA512
dbb7571f6cb6ae4c1d2f93b55c46e6c897732bdced8007e1db6eae7d0d780e62530a3f25834d98c8ccd869b81b9a16b56c3650b5c640e52a27c94bd17c6b9cf6
-
SSDEEP
3072:gO0Q1Hi9SznFHYVBGYwXeD8NwlIIlCZa8G5VChmGMcyna51:r1Hi9SznhYVBtD8N3eCZzG/5dc7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 13d21cdb01a2e3111a31487da8e7716e_JaffaCakes118
Files
-
13d21cdb01a2e3111a31487da8e7716e_JaffaCakes118.dll windows:5 windows x86 arch:x86
84bf5381622e62484a2aa29da9d3ed54
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetCurrentProcessId
HeapAlloc
HeapFree
GetProcessHeap
GetLastError
VerSetConditionMask
VerifyVersionInfoW
Sleep
GetProcAddress
LoadLibraryA
GetModuleFileNameW
OpenFileMappingW
MapViewOfFile
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
InitializeCriticalSection
GetModuleFileNameA
QueryDosDeviceW
Process32FirstW
MultiByteToWideChar
TerminateProcess
CreateFileW
ReadFile
SetStdHandle
FlushFileBuffers
HeapReAlloc
UnmapViewOfFile
CreateFileMappingW
WideCharToMultiByte
OpenProcess
ExpandEnvironmentStringsA
GetLogicalDriveStringsW
CreateProcessW
VirtualQuery
GetFullPathNameA
CreateFileA
GetCurrentProcess
GetTempFileNameA
MoveFileA
GetModuleHandleA
GetVersionExA
LocalFree
DeleteFileA
GetFileSize
SetFilePointer
MapViewOfFileEx
WriteFile
SetLastError
GetCurrentThreadId
DecodePointer
GetCommandLineA
RaiseException
WriteConsoleW
GetFileType
GetStdHandle
EncodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
ExitProcess
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
HeapSize
LCMapStringW
GetStringTypeW
InterlockedExchange
GetConsoleCP
GetConsoleMode
RtlUnwind
advapi32
SetEntriesInAclW
SetSecurityDescriptorDacl
InitializeAcl
AllocateAndInitializeSid
AddAccessAllowedAce
FreeSid
OpenProcessToken
LookupPrivilegeValueA
SetNamedSecurityInfoW
InitializeSecurityDescriptor
AdjustTokenPrivileges
GetLengthSid
psapi
GetModuleFileNameExW
GetProcessImageFileNameW
ws2_32
ntohs
getnameinfo
iphlpapi
GetAdaptersInfo
crypt32
CertOpenStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateContext
CryptStringToBinaryW
Exports
Exports
AddCertificateContextToStore
AddCertificateCryptContextToStore
Fundadores
SetAPIPort
SetAPIPort2
SetBusinessData
SetBusinessData2
Sections
.text Size: 113KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ