c:\Documents and Settings\Slava\Desktop\CLinker\CLinker\Release\CLinker.pdb
Static task
static1
Behavioral task
behavioral1
Sample
00d63de1fae1176d0816af73dfd3b705_JaffaCakes118.dll
Resource
win7-20240508-en
General
-
Target
00d63de1fae1176d0816af73dfd3b705_JaffaCakes118
-
Size
140KB
-
MD5
00d63de1fae1176d0816af73dfd3b705
-
SHA1
dbccb676e4c255e1610a5381871bb9b370318e00
-
SHA256
50cf370f85f4e0a15e2dda3a139c04b4f26e4953f4e18fd585620c43d23dae6d
-
SHA512
54470102d2632a16062414c42234eb1b00fcc78790d0e3ce3b5030c698e2eecc8ac28ae7f50c59468a230da0c935ded91455cbd303b03847309e552dbce36cec
-
SSDEEP
1536:AbTiwFYmsaxrBw7ohEebxUs89WPltLpezrk48C/QC3hZI+a8XZtbkGdpk2V7:AbTiY5vEebb/biZhZKytbnf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00d63de1fae1176d0816af73dfd3b705_JaffaCakes118
Files
-
00d63de1fae1176d0816af73dfd3b705_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
c350d5256f31ac06c899b79d1e311912
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SetThreadLocale
DeleteCriticalSection
RaiseException
EnterCriticalSection
InitializeCriticalSection
lstrlenW
GetLastError
GetModuleFileNameW
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
CreateFileW
GetFileTime
GetSystemTime
SystemTimeToFileTime
CloseHandle
DeleteFileW
GetThreadLocale
SetFileAttributesW
HeapCreate
HeapAlloc
HeapFree
WideCharToMultiByte
lstrlenA
GetConsoleOutputCP
WriteConsoleA
ReadFile
FlushFileBuffers
SetStdHandle
CreateFileA
DisableThreadLibraryCalls
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
lstrcmpiW
DeleteFileA
FreeLibrary
SetEndOfFile
LCMapStringW
GetOEMCP
GetCPInfo
LoadLibraryA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
WriteConsoleW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
HeapReAlloc
GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleA
GetSystemInfo
VirtualQuery
GetCurrentThreadId
GetCommandLineA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
HeapDestroy
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
HeapSize
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
GetConsoleCP
user32
SetTimer
IsWindowVisible
KillTimer
CloseWindow
CharNextW
UnregisterClassA
advapi32
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryValueExW
ole32
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
oleaut32
SysStringLen
DispCallFunc
LoadRegTypeLi
VariantInit
VariantClear
SysFreeString
LoadTypeLi
SysAllocString
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
wininet
FindCloseUrlCache
DeleteUrlCacheEntryW
FindFirstUrlCacheEntryW
InternetCloseHandle
InternetReadFile
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW
FindNextUrlCacheEntryW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 92KB - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ