e:\V100r006b002d09sp00c03\utps\solution\win32\Ndisapi\Release\NDISAPI.pdb
Static task
static1
Behavioral task
behavioral1
Sample
22733bfe874dfb76a1d27caeffe272b2_JaffaCakes118.dll
Resource
win7-20240220-en
General
-
Target
22733bfe874dfb76a1d27caeffe272b2_JaffaCakes118
-
Size
1.0MB
-
MD5
22733bfe874dfb76a1d27caeffe272b2
-
SHA1
fbed3114d88093a4339fc17a72e48efb0d449434
-
SHA256
3112129b00b49f28720744334d70885f4a43c3a0cb270162ca18351fde8ed486
-
SHA512
0ffb41aa70079e4c8ae172500af1967439aebc1bcb19ae16ec45893ce9ebcbc38414f2564dd7882f8d674db9f5c53e99f689275c48858221c3663e5fd9fd7ad6
-
SSDEEP
12288:4JiHwpBEkLYk8HC8y6LTpZ4cVruYcdmM096/TTjoLbav9VFPb6lis/O8bh0CX4de:4JiHC8i8V+hYcXdPFOlis/Fbh0Y+iXV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 22733bfe874dfb76a1d27caeffe272b2_JaffaCakes118
Files
-
22733bfe874dfb76a1d27caeffe272b2_JaffaCakes118.dll windows:4 windows x86 arch:x86
417c2f4a547098356f34811949a99b1d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
setupapi
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
CM_Locate_DevNodeA
SetupDiGetDeviceInstanceIdA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiCallClassInstaller
SetupDiEnumDeviceInterfaces
CM_Reenumerate_DevNode
SetupDiGetDeviceRegistryPropertyA
CM_Get_DevNode_Status
kernel32
LoadLibraryA
IsBadCodePtr
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
CreateEventA
ResetEvent
WaitForSingleObject
Sleep
SetEvent
WaitForMultipleObjects
WriteFile
CreateFileA
CreateMutexA
GetModuleFileNameA
GetOEMCP
SetFilePointer
GetLocalTime
MultiByteToWideChar
WideCharToMultiByte
CreateThread
OutputDebugStringA
lstrlenA
lstrlenW
InterlockedIncrement
InterlockedDecrement
GetLastError
CancelIo
GetOverlappedResult
ReadFile
LeaveCriticalSection
EnterCriticalSection
DeviceIoControl
TerminateThread
IsBadReadPtr
IsValidCodePage
SetStdHandle
FlushFileBuffers
GetLocaleInfoW
ReleaseMutex
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
ExitProcess
RtlUnwind
HeapFree
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
LCMapStringA
LCMapStringW
GetCPInfo
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
VirtualQuery
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
SetUnhandledExceptionFilter
VirtualProtect
GetSystemInfo
TerminateProcess
GetCurrentProcess
HeapSize
SetHandleCount
GetStdHandle
GetStringTypeW
advapi32
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegNotifyChangeKeyValue
RegOpenKeyExA
RegCloseKey
ole32
CoCreateInstance
CoInitializeEx
oleaut32
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SysAllocStringLen
VarBstrCmp
SysFreeString
shlwapi
PathFileExistsA
Exports
Exports
NdisCancelConnect
NdisConnect
NdisConnectionNotification
NdisDestroyInstance
NdisDisconnect
NdisGetConnState
NdisGetDeviceCount
NdisGetDeviceName
NdisOnPowerbroadcast
NdisSelectDevice
Sections
.text Size: 632KB - Virtual size: 630KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 120KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 120KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 832B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 112KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE