O:\OOO330\ooo\neon\wntmsci12.pro\bin\neon.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0a02f0b50aba829d1465f7c1ce166df7_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0a02f0b50aba829d1465f7c1ce166df7_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
0a02f0b50aba829d1465f7c1ce166df7_JaffaCakes118
-
Size
108KB
-
MD5
0a02f0b50aba829d1465f7c1ce166df7
-
SHA1
8443959883c9482194ac3f1d6f61441cd60798e5
-
SHA256
2f43f5f98e0bf735bec41d26a6ce4d60e0db7a22207b777822b434bc3c7b28bf
-
SHA512
275772d3d9c56325d4becd615c5b1a85e987ed95487608305725ce6ae9148185ac4537d78b837e8d197a765d2d0c227f7d682ee8bdb6f4ed6b415e99fd702c45
-
SSDEEP
3072:AaSwKIe6tkPxqz/PH8emx67ltLDVGjBPU:3Fe62PxqTPSw7ltLDVGjB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a02f0b50aba829d1465f7c1ce166df7_JaffaCakes118
Files
-
0a02f0b50aba829d1465f7c1ce166df7_JaffaCakes118.dll windows:5 windows x86 arch:x86
4c1e921e73830bad4bd4a92221dc04eb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
libxml2
xmlFreeParserCtxt
xmlParseChunk
xmlCreatePushParserCtxt
xmlCtxtUseOptions
wsock32
accept
getpeername
socket
closesocket
setsockopt
bind
connect
send
recv
select
WSACleanup
WSAStartup
WSASetLastError
getservbyport
ntohs
gethostbyaddr
htons
getservbyname
htonl
inet_addr
gethostbyname
WSAGetLastError
ioctlsocket
ws2_32
WSASend
ssleay32
ord60
ord61
ord132
ord242
ord74
ord183
ord180
ord8
ord31
ord73
ord16
ord141
ord24
ord222
ord110
ord12
ord284
ord6
ord21
ord112
ord115
ord56
ord157
ord175
ord151
ord96
ord127
ord130
ord154
ord158
ord90
ord43
ord48
ord75
ord87
ord35
ord45
ord108
ord78
ord58
ord77
libeay32
ord905
ord910
ord2411
ord1299
ord198
ord3212
ord333
ord639
ord857
ord754
ord2135
ord411
ord391
ord636
ord1309
ord1304
ord2074
ord2639
ord364
ord2684
ord1271
ord444
ord630
ord624
ord680
ord640
ord1018
ord1017
ord1016
ord653
ord1958
ord1654
ord1653
ord1214
ord909
ord657
ord579
ord566
ord1291
ord281
ord641
ord572
ord362
ord576
ord578
ord356
ord2442
ord181
ord1
ord227
ord253
ord2206
ord2254
ord222
msvcr90
_fstat64i32
strstr
memchr
_gmtime64
_mktime64
sscanf
atoi
isdigit
ferror
fread
strrchr
strncpy
strncat
strcpy_s
calloc
strncpy_s
sprintf_s
strcat_s
memmove
strerror
isxdigit
setvbuf
vfprintf
fflush
__iob_func
fclose
fopen
_strdup
_vsnprintf
_encode_pointer
_timezone
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_strnicmp
_lseek
_read
_write
strtol
sprintf
abort
malloc
memset
realloc
free
memcpy
_time64
strncmp
strchr
strtoul
_errno
kernel32
UnhandledExceptionFilter
GetTimeZoneInformation
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
FormatMessageA
GetSystemDirectoryA
Exports
Exports
GetVersionInfo
ne_207_create
ne_207_destroy
ne_207_get_current_propstat
ne_207_get_current_response
ne_207_set_propstat_handlers
ne_207_set_response_handlers
ne__negotiate_ssl
ne__sock_sslsock
ne__ssl_exit
ne__ssl_init
ne__ssl_set_verify_err
ne_accept_207
ne_accept_2xx
ne_accept_always
ne_acl3744_set
ne_add_depth_header
ne_add_proxy_auth
ne_add_request_header
ne_add_response_body_reader
ne_add_server_auth
ne_addr_destroy
ne_addr_error
ne_addr_first
ne_addr_next
ne_addr_resolve
ne_addr_result
ne_ascii_to_md5
ne_asctime_parse
ne_base64
ne_begin_request
ne_buffer_altered
ne_buffer_append
ne_buffer_clear
ne_buffer_concat
ne_buffer_create
ne_buffer_destroy
ne_buffer_finish
ne_buffer_grow
ne_buffer_ncreate
ne_buffer_snprintf
ne_buffer_zappend
ne_calloc
ne_close_connection
ne_concat
ne_copy
ne_debug
ne_debug_init
ne_debug_mask
ne_debug_stream
ne_decompress_destroy
ne_decompress_reader
ne_delete
ne_discard_response
ne_end_request
ne_fill_proxy_uri
ne_fill_server_uri
ne_forget_auth
ne_free
ne_get
ne_get_content_type
ne_get_error
ne_get_range
ne_get_request_flag
ne_get_request_private
ne_get_response_header
ne_get_scheme
ne_get_server_hostport
ne_get_session
ne_get_session_flag
ne_get_session_private
ne_get_status
ne_getmodtime
ne_has_support
ne_hook_close_conn
ne_hook_create_request
ne_hook_destroy_request
ne_hook_destroy_session
ne_hook_post_headers
ne_hook_post_send
ne_hook_pre_send
ne_httpdate_parse
ne_i18n_init
ne_iaddr_cmp
ne_iaddr_free
ne_iaddr_make
ne_iaddr_print
ne_iaddr_reverse
ne_iaddr_typeof
ne_iso8601_parse
ne_lock
ne_lock_copy
ne_lock_create
ne_lock_destroy
ne_lock_discover
ne_lock_free
ne_lock_refresh
ne_lock_using_parent
ne_lock_using_resource
ne_lockstore_add
ne_lockstore_create
ne_lockstore_destroy
ne_lockstore_findbyuri
ne_lockstore_first
ne_lockstore_next
ne_lockstore_register
ne_lockstore_remove
ne_malloc
ne_md5_create_ctx
ne_md5_destroy_ctx
ne_md5_dup_ctx
ne_md5_finish_ascii
ne_md5_finish_ctx
ne_md5_process_block
ne_md5_process_bytes
ne_md5_read_ctx
ne_md5_reset_ctx
ne_md5_stream
ne_md5_to_ascii
ne_mkcol
ne_move
ne_oom_callback
ne_options
ne_options2
ne_parse_statusline
ne_path_childof
ne_path_compare
ne_path_escape
ne_path_has_trailing_slash
ne_path_parent
ne_path_unescape
ne_post
ne_print_request_header
ne_propfind_allprop
ne_propfind_create
ne_propfind_current_private
ne_propfind_destroy
ne_propfind_get_parser
ne_propfind_get_request
ne_propfind_named
ne_propfind_set_private
ne_propnames
ne_proppatch
ne_propset_iterate
ne_propset_lang
ne_propset_private
ne_propset_status
ne_propset_value
ne_put
ne_qtoken
ne_read_response_block
ne_read_response_to_fd
ne_realloc
ne_redirect_location
ne_redirect_register
ne_request_create
ne_request_destroy
ne_request_dispatch
ne_response_header_iterate
ne_rfc1036_parse
ne_rfc1123_date
ne_rfc1123_parse
ne_session_create
ne_session_destroy
ne_session_proxy
ne_set_addrlist
ne_set_connect_timeout
ne_set_error
ne_set_localaddr
ne_set_notifier
ne_set_progress
ne_set_proxy_auth
ne_set_read_timeout
ne_set_request_body_buffer
ne_set_request_body_fd
ne_set_request_body_provider
ne_set_request_flag
ne_set_request_private
ne_set_server_auth
ne_set_session_flag
ne_set_session_private
ne_set_useragent
ne_shave
ne_simple_propfind
ne_simple_request
ne_snprintf
ne_sock_accept
ne_sock_accept_ssl
ne_sock_block
ne_sock_cipher
ne_sock_close
ne_sock_connect
ne_sock_connect_ssl
ne_sock_connect_timeout
ne_sock_create
ne_sock_error
ne_sock_exit
ne_sock_fd
ne_sock_fullread
ne_sock_fullwrite
ne_sock_init
ne_sock_peek
ne_sock_peer
ne_sock_prebind
ne_sock_proxy
ne_sock_read
ne_sock_read_timeout
ne_sock_readline
ne_sock_sessid
ne_ssl_cert_cmp
ne_ssl_cert_digest
ne_ssl_cert_export
ne_ssl_cert_free
ne_ssl_cert_identity
ne_ssl_cert_import
ne_ssl_cert_issuer
ne_ssl_cert_read
ne_ssl_cert_signedby
ne_ssl_cert_subject
ne_ssl_cert_validity
ne_ssl_cert_validity_time
ne_ssl_cert_write
ne_ssl_clicert_decrypt
ne_ssl_clicert_encrypted
ne_ssl_clicert_free
ne_ssl_clicert_name
ne_ssl_clicert_owner
ne_ssl_clicert_read
ne_ssl_context_create
ne_ssl_context_destroy
ne_ssl_context_keypair
ne_ssl_context_set_flag
ne_ssl_context_set_verify
ne_ssl_context_trustcert
ne_ssl_dname_cmp
ne_ssl_provide_clicert
ne_ssl_readable_dname
ne_ssl_set_clicert
ne_ssl_set_verify
ne_ssl_trust_cert
ne_ssl_trust_default_ca
ne_sspi_authenticate
ne_sspi_clear_context
ne_sspi_create_context
ne_sspi_deinit
ne_sspi_destroy_context
ne_sspi_init
ne_strcasecmp
ne_strclean
ne_strdup
ne_strerror
ne_strncasecmp
ne_strndup
ne_token
ne_tolower_array
ne_unbase64
ne_unhook_close_conn
ne_unhook_create_request
ne_unhook_destroy_request
ne_unhook_destroy_session
ne_unhook_post_headers
ne_unhook_post_send
ne_unhook_pre_send
ne_unlock
ne_uri_cmp
ne_uri_copy
ne_uri_defaultport
ne_uri_free
ne_uri_parse
ne_uri_resolve
ne_uri_unparse
ne_version_match
ne_version_pre_http11
ne_version_string
ne_vsnprintf
ne_xml_create
ne_xml_currentline
ne_xml_destroy
ne_xml_dispatch_request
ne_xml_doc_encoding
ne_xml_failed
ne_xml_get_attr
ne_xml_get_error
ne_xml_mapid
ne_xml_parse
ne_xml_parse_response
ne_xml_parse_v
ne_xml_push_handler
ne_xml_resolve_nspace
ne_xml_set_error
Sections
.text Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ