c:\55\Out\Energy\war\75\Region\70\Famous\divide\Win\shoe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
98b18cdd57be2e9c4cbe26882dbed293_JaffaCakes118.dll
Resource
win7-20240215-en
General
-
Target
98b18cdd57be2e9c4cbe26882dbed293_JaffaCakes118
-
Size
397KB
-
MD5
98b18cdd57be2e9c4cbe26882dbed293
-
SHA1
1e97f13752d17288b8407d7a9915272c29ba7086
-
SHA256
b08cef1d01353f794ac2fe61edc97100fbabf82bc9489288c1d8c30fe8221822
-
SHA512
eaac08996089a7bf37f506ac253b69c7bf3fc3c09811f3814f0743f7598639badd17e3c3c7edf99b4496c096758199f372687acf14af261a997304bedea23012
-
SSDEEP
6144:fWBPIXnZ8w+PS1s4LsdAj9Js5SwwLBYkgI2i/goeyn07+BKgl:lXZ8wWSi+sVQwot1/Rey07+Egl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 98b18cdd57be2e9c4cbe26882dbed293_JaffaCakes118
Files
-
98b18cdd57be2e9c4cbe26882dbed293_JaffaCakes118.dll windows:6 windows x86 arch:x86
a4c689a518d772b55cdfd55a024b6a14
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LoadLibraryA
GetModuleFileNameA
CreateProcessA
GetStartupInfoA
GetEnvironmentVariableA
GetCurrentDirectoryA
GetFileAttributesA
DeleteFileA
CopyFileA
GetTickCount
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetFilePointerEx
SetStdHandle
GetStringTypeW
FreeEnvironmentStringsW
CloseHandle
Sleep
ExitProcess
DecodePointer
VirtualProtectEx
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
EncodePointer
RaiseException
RtlUnwind
InterlockedFlushSList
GetLastError
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
HeapAlloc
HeapValidate
GetSystemInfo
GetStdHandle
GetFileType
WriteFile
OutputDebugStringW
WriteConsoleW
LCMapStringW
HeapFree
HeapReAlloc
HeapSize
HeapQueryInformation
GetProcessHeap
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
CreateFileW
user32
DrawFrameControl
PostMessageA
GetActiveWindow
AppendMenuA
TrackPopupMenu
FillRect
IsDialogMessageA
ole32
OleUninitialize
OleSetContainedObject
OleInitialize
comctl32
ImageList_Draw
PropertySheetA
CreatePropertySheetPageA
ImageList_SetDragCursorImage
oledlg
ord6
ord7
ord2
ord11
ord1
Exports
Exports
Bringfoot
Crybrother
Loud1
Sections
.text Size: 377KB - Virtual size: 377KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 994B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ