dnsrslvr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1a60c0950f848b8e2f7b5cbd921c27a8_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1a60c0950f848b8e2f7b5cbd921c27a8_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
1a60c0950f848b8e2f7b5cbd921c27a8_JaffaCakes118
-
Size
100KB
-
MD5
1a60c0950f848b8e2f7b5cbd921c27a8
-
SHA1
aa96fb11bb2c5ad726067730830c68ab6a6c6c01
-
SHA256
eeba51d53d120941270791632dae6edf2ba15c3b776d0e9fcafc565d2f98e27f
-
SHA512
500e87c08547fa863640fb99ca93402f2c7933db8ae7950caa1e0a6e097296cf464cb32a949a95e51d07cf31af618b91dcb9c7948a69d699c955b4d7e9f2be0f
-
SSDEEP
3072:X4XehnZu2XLhxrt2IuWhDZdRm665aDQM40sI:X4XexZu2Xl5AIfDZdRO5asM4y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a60c0950f848b8e2f7b5cbd921c27a8_JaffaCakes118
Files
-
1a60c0950f848b8e2f7b5cbd921c27a8_JaffaCakes118.dll windows:5 windows x86 arch:x86
26912ab4e1a4ffbfcc72262d3a008218
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
wcscmp
strncpy
_vsnprintf
_wcsicmp
wcscat
wcscpy
wcslen
vsprintf
fputs
fopen
fclose
time
localtime
fprintf
advapi32
ReportEventW
OpenThreadToken
MapGenericMask
AccessCheck
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
FreeSid
IsValidSecurityDescriptor
SetServiceStatus
DeregisterEventSource
RegisterEventSourceW
RegisterServiceCtrlHandlerW
kernel32
CreateThread
lstrlenA
GetTickCount
GetCurrentThreadId
InterlockedIncrement
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
HeapCreate
WaitForSingleObject
GetSystemDirectoryW
TerminateThread
FindNextChangeNotification
WaitForMultipleObjects
Sleep
SetLastError
GetCurrentThread
DisableThreadLibraryCalls
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LocalAlloc
OutputDebugStringA
ResetEvent
GetOverlappedResult
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateEventW
InterlockedExchange
SetEvent
CloseHandle
DeleteCriticalSection
GetLastError
InterlockedCompareExchange
LocalFree
CreateEventA
LCMapStringW
CompareStringA
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
FindFirstChangeNotificationW
user32
wsprintfW
rpcrt4
RpcServerInqBindings
RpcEpUnregister
RpcBindingVectorFree
RpcServerUnregisterIf
RpcImpersonateClient
RpcRevertToSelf
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcServerListen
RpcBindingToStringBindingW
RpcStringFreeW
RpcStringBindingParseW
NdrServerCall2
dnsapi
DnsApiAlloc
DnsApiRealloc
DnsApiFree
NetInfo_Free
NetInfo_Clean
DnsGlobals
NetInfo_Copy
NetInfo_Build
NetInfo_ResetServerPriorities
Reg_ReadGlobalsEx
DnsGetLocalAddrArrayDirect
DnsNameCompare_W
Dns_InitializeWinsock
Dns_InitQueryTimeouts
Dns_CacheSocketInit
Dns_CacheSocketCleanup
Dns_CleanupWinsock
Dns_ReadHostFileLine
Dns_OpenHostFile
GetCurrentTimeInSeconds
Query_Main
DnsStatusString
Dns_UpdateLib
Dns_FindAuthoritativeZoneLib
Dns_CloseHostFile
iphlpapi
NotifyAddrChange
Exports
Exports
ServiceMain
SvchostPushServiceGlobals
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ