pdb.pdb
Static task
static1
Behavioral task
behavioral1
Sample
216edc2a3f5f73c1d76b3cd267c98534_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
216edc2a3f5f73c1d76b3cd267c98534_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
216edc2a3f5f73c1d76b3cd267c98534_JaffaCakes118
-
Size
80KB
-
MD5
216edc2a3f5f73c1d76b3cd267c98534
-
SHA1
42c45c6feff8e17c550ca26ce8e21d85058168d1
-
SHA256
07bbbfb547a5a340520d47147d9c8dc3900f370fcd190532fb2e886cc43b7725
-
SHA512
aa694339832889197a255eddbdb0ae2109dc504dd0be636c77ad36cb8651466cf6d1192c0c3f857af8c35d44a952890107d6e580216ce83708626b9b886d6b0c
-
SSDEEP
768:jlGWIZNelaAcGR2acDvZSBwQdxYgSq+jc7WUCHpAr8N3YTC+eU5K3QUEYU5OLMh5:XzBo/D3QdfU+CHDZYTHqtEDOoDteQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 216edc2a3f5f73c1d76b3cd267c98534_JaffaCakes118
Files
-
216edc2a3f5f73c1d76b3cd267c98534_JaffaCakes118.dll windows:4 windows x86 arch:x86
4fcad3748b5122a42fe9ec2fbcf0f0a6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SetFilePointer
GetFileType
GetCurrentThreadId
GetLocaleInfoA
GetSystemInfo
TlsFree
UnmapViewOfFile
SetEndOfFile
GetStdHandle
GetEnvironmentVariableA
InterlockedExchange
lstrcmpA
EnterCriticalSection
MultiByteToWideChar
WriteFile
GetCPInfo
CreateThread
CreateFileA
LocalAlloc
HeapFree
GetTickCount
CreateMutexW
Sleep
IsDBCSLeadByte
DeleteCriticalSection
SetHandleCount
lstrlenW
HeapAlloc
TlsAlloc
VirtualAlloc
DeleteFileA
GetFullPathNameW
OpenFileMappingA
OpenFileMappingW
HeapDestroy
GetFullPathNameA
LocalFree
ReleaseMutex
lstrcmpiA
GetVersionExA
GetACP
GetLastError
VirtualQuery
FreeEnvironmentStringsA
lstrlenA
GetEnvironmentStringsW
GetProcAddress
LoadLibraryA
FreeLibrary
HeapReAlloc
FlushViewOfFile
CompareFileTime
SetUnhandledExceptionFilter
DeleteFileW
GetStringTypeW
GetDiskFreeSpaceW
LeaveCriticalSection
TerminateProcess
CloseHandle
MoveFileW
CreateEventA
GetFileSize
MoveFileA
SetFileTime
VirtualProtect
QueryPerformanceCounter
InitializeCriticalSection
WideCharToMultiByte
CreateFileMappingA
GetDiskFreeSpaceA
SetEvent
GetCurrentProcessId
MapViewOfFile
UnhandledExceptionFilter
InterlockedDecrement
TlsGetValue
CreateFileW
GetStringTypeExA
GetStringTypeA
DisableThreadLibraryCalls
HeapCreate
WaitForSingleObject
SetLastError
GetStartupInfoA
GetOEMCP
CreateMutexA
InterlockedIncrement
IsBadReadPtr
VirtualFree
InitializeCriticalSectionAndSpinCount
CreateFileMappingW
GetSystemTimeAsFileTime
GetCurrentProcess
LCMapStringA
GetEnvironmentStrings
FreeEnvironmentStringsW
EnumDateFormatsExA
Exports
Exports
qxlmzan
Sections
.text Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 558B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ