E:\WANhttp_encode\Release\CMDRedirect.pdb
Static task
static1
Behavioral task
behavioral1
Sample
66db2090c03e65fc7ffccae8a801b4a6_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
66db2090c03e65fc7ffccae8a801b4a6_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
66db2090c03e65fc7ffccae8a801b4a6_JaffaCakes118
-
Size
256KB
-
MD5
66db2090c03e65fc7ffccae8a801b4a6
-
SHA1
2369c707ef9c9cba7efd76995e7fcca1bff21ace
-
SHA256
533ebe3a1f9734c30db7ce0462ff6366d09c2df3a3c748cfc261fc9bdbbdc24c
-
SHA512
e46318689c5e3e2d8bee07cbf1b5aba99aef026cead2f25100272411eab2f02dcc0dd9011889f3c00ebb4963faed8f37964dca2d8795713afcf3292b039c5c0d
-
SSDEEP
6144:gMlLg3zG6nqv88Bd9KvxAVXZLEpmSVz/i0Wfk7JEE:XlLeqv88Bd90xmZLrSJ/i0Wfkd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 66db2090c03e65fc7ffccae8a801b4a6_JaffaCakes118
Files
-
66db2090c03e65fc7ffccae8a801b4a6_JaffaCakes118.dll windows:5 windows x86 arch:x86
174943b8848d559ef21a5c81c5168aae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleFileNameA
CreateToolhelp32Snapshot
CloseHandle
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetVersionExA
GetCurrentProcessId
OpenFileMappingA
ExitProcess
GetCommandLineW
CreateProcessW
HeapAlloc
GetCurrentProcess
HeapFree
GetTickCount
GetProcessHeap
CopyFileW
MultiByteToWideChar
CreateFileMappingA
FindClose
GetLocalTime
ResumeThread
DeleteFileA
GetCommandLineA
GlobalAlloc
GlobalFree
FindFirstFileW
Sleep
CreateFileW
FindNextFileW
GetCurrentThreadId
CreateThread
Process32Next
GetLogicalDriveStringsA
TerminateProcess
CreateProcessA
WideCharToMultiByte
OpenProcess
ExpandEnvironmentStringsA
Process32First
QueryDosDeviceA
VirtualQuery
VirtualProtect
VirtualAlloc
VirtualFree
SetEndOfFile
FlushFileBuffers
UnmapViewOfFile
SetLastError
SetStdHandle
LoadLibraryW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetLocaleInfoW
GetUserDefaultLCID
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetFullPathNameA
CreateFileA
CopyFileA
MoveFileA
LocalFree
GetFileSize
SetFilePointer
MapViewOfFileEx
WriteFile
CreateFileMappingW
OutputDebugStringW
CreateDirectoryA
OutputDebugStringA
HeapReAlloc
RaiseException
RtlUnwind
CompareStringW
GetCPInfo
LCMapStringW
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
HeapSize
InitializeCriticalSectionAndSpinCount
ReadFile
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStartupInfoW
FreeEnvironmentStringsW
MapViewOfFile
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
SetNamedSecurityInfoW
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
shlwapi
PathCombineW
PathStripPathW
PathRemoveFileSpecW
PathGetArgsW
PathFileExistsW
PathAddBackslashW
iphlpapi
GetAdaptersInfo
psapi
GetProcessImageFileNameA
GetModuleFileNameExA
version
GetFileVersionInfoW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoSizeW
ws2_32
WSAStartup
gethostname
WSACleanup
Exports
Exports
?_@@YAXXZ
Fundadores
Sections
.text Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ