C:\Users\Mr.Anderson\Desktop\Windows-classic-samples-master\Windows-classic-samples-master\Samples\Win7Samples\winbase\DeviceFoundation\DeviceFolderExtensibility\Release\Win32\DevicePropertyPage.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1d0ee5fd01f5abff1dedd5ce5b909e93_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
1d0ee5fd01f5abff1dedd5ce5b909e93_JaffaCakes118
-
Size
329KB
-
MD5
1d0ee5fd01f5abff1dedd5ce5b909e93
-
SHA1
9d4436180f788b10e25c722b92f14aa667605f97
-
SHA256
4a5fe72160ae5a32d792fbdb951ccc4f734b1a1d801f74beebf520a347409c20
-
SHA512
b83d53e3995c244521cac8c15edfdb97087fb9d54b52d28a287c613234ae9e7a849af98cfc33f483d95f660c998adf0c907e87f7033af9fefab9324377d8895f
-
SSDEEP
6144:TQ9W5ur84gWF6l0by8tca3hUXuwbN39IVorI1ZNSm:s9f84rEl07Wa3Gfb1+gI7Nb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1d0ee5fd01f5abff1dedd5ce5b909e93_JaffaCakes118
Files
-
1d0ee5fd01f5abff1dedd5ce5b909e93_JaffaCakes118.dll regsvr32 windows:6 windows x86 arch:x86
cfcf952785838426851201af954c6476
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
comctl32
DestroyPropertySheetPage
CreatePropertySheetPageW
setupapi
SetupDiCreateDeviceInfoList
SetupDiOpenDeviceInfoW
SetupDiDestroyDeviceInfoList
SetupDiGetDevicePropertyW
kernel32
FileTimeToSystemTime
GetDateFormatEx
DisableThreadLibraryCalls
GetModuleFileNameW
GetLastError
LoadLibraryExW
SetFilePointerEx
ReadFile
OutputDebugStringW
SetStdHandle
WriteConsoleW
ReadConsoleW
CreateFileW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
CloseHandle
HeapReAlloc
WriteFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
HeapFree
RaiseException
RtlUnwind
GetCommandLineA
GetCurrentThreadId
GetCPInfo
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsDebuggerPresent
ExitProcess
GetModuleHandleExW
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
GetStdHandle
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
user32
DestroyIcon
SetDlgItemTextW
GetDlgItem
SendMessageW
ShowWindow
advapi32
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyW
shell32
ord77
ord155
ord727
SHGetItemFromObject
ole32
PropVariantClear
CoTaskMemFree
StringFromGUID2
StringFromCLSID
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ