C:\users\williamg\Projects\FromScratch\_ship\fluidmask\_b-vc8-ship\_b-gaspipe3\gaspipe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9ba5a808799f99c38e2b16fde31d799a_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9ba5a808799f99c38e2b16fde31d799a_JaffaCakes118.dll
Resource
win10v2004-20240426-en
General
-
Target
9ba5a808799f99c38e2b16fde31d799a_JaffaCakes118
-
Size
211KB
-
MD5
9ba5a808799f99c38e2b16fde31d799a
-
SHA1
9107c981de41c15444842134a135bf761e113ef8
-
SHA256
0c77dbc8435c7d3921bc71169003151ce3347a7a01998f648ac18440a5df20e1
-
SHA512
d745c0f00116fea4557f22e986738cbb5d6585df81cd7a92691dd58de3d556dbd1d14eb8372ae295e3d151ba03c14b9ef753c5cc92d1658a0cf0dfbae8a4e49d
-
SSDEEP
3072:3pl5sQLJlmK8TZNDLaDoz3ackLGvBHCKwvt9YMwZ5bWY+KGRl:+QLutNDm0zafpTC31o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9ba5a808799f99c38e2b16fde31d799a_JaffaCakes118
Files
-
9ba5a808799f99c38e2b16fde31d799a_JaffaCakes118.dll windows:4 windows x86 arch:x86
d2966d270ddceda8e6e8a8933ed91463
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
user32
IsWindowEnabled
ShowWindow
GetActiveWindow
MessageBoxA
EnableWindow
kernel32
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
CreateFileW
CreateFileA
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetVersionExA
GetBinaryTypeA
GetLastError
CreateFileMappingA
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetProcessHeap
RtlUnwind
RaiseException
GetCPInfo
LCMapStringA
LCMapStringW
GetProcAddress
GetModuleHandleA
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
HeapSize
GetTimeZoneInformation
SetFilePointer
ReadFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LoadLibraryA
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetFileAttributesA
Exports
Exports
PluginMain
Sections
.text Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ