C:\build\source\tfilesys\rel32\tfilesys.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2169fcd846792a23c117744dfc8e370f_JaffaCakes118.dll
Resource
win7-20240611-en
General
-
Target
2169fcd846792a23c117744dfc8e370f_JaffaCakes118
-
Size
156KB
-
MD5
2169fcd846792a23c117744dfc8e370f
-
SHA1
d290fccfd9ae7e8eb33421eabbb96e1ff3a5bcdc
-
SHA256
cdfc9b95dd6509990a8e031e06a05a93cb4ce05df15843b21f696b5ec58b03cb
-
SHA512
d97a3081ca77870c1d3b9430b0713b856476405782bbdb82c801f9454751ec969727649ce86993a4a55b9197630d5332ddab931b614d85171209dfb0ffa46d33
-
SSDEEP
3072:MR9T8dl6tcUdPxg/EEyKt+O1/ImRlojVwUgw2nhQKVOzxFoGo82p/ADBCrN/+hUD:MwC/g/vt+O1/7RUkTQxFoGQLrzxoekg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2169fcd846792a23c117744dfc8e370f_JaffaCakes118
Files
-
2169fcd846792a23c117744dfc8e370f_JaffaCakes118.dll windows:5 windows x86 arch:x86
c139c5c7919cdda91b8459a8bd07aab2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
InterlockedIncrement
InterlockedDecrement
lstrlenA
GetProcAddress
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
FreeLibrary
LoadLibraryA
lstrcpyA
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
IsDebuggerPresent
user32
CharUpperA
CharNextA
GetSystemMetrics
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyA
winmm
timeKillEvent
timeSetEvent
msvcp90
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
msvcr90
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
??0exception@std@@QAE@XZ
??_V@YAXPAX@Z
ftell
fseek
_fsopen
fclose
fread
memcpy
sprintf
_splitpath
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
memset
rename
_invalid_parameter_noinfo
malloc
free
strrchr
_ismbcspace
atol
_vsnprintf
memmove
__CxxFrameHandler3
strncpy
strchr
_stricmp
??2@YAPAXI@Z
strncmp
_strnicmp
_purecall
strtok
_findfirst32
_findnext32
_findclose
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
_except_handler4_common
_stat32
_fstat32
isdigit
strstr
_fileno
_unlink
_mkdir
realloc
_strlwr
Exports
Exports
CanUnload
RMACreateInstance
RMAShutdown
TFileSys_GetLastError
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 108KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE