e:\src\teawave\teawave.pdb
Static task
static1
Behavioral task
behavioral1
Sample
22b62cd4195dc3a0d71bc63c4802c747_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
22b62cd4195dc3a0d71bc63c4802c747_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
22b62cd4195dc3a0d71bc63c4802c747_JaffaCakes118
-
Size
120KB
-
MD5
22b62cd4195dc3a0d71bc63c4802c747
-
SHA1
26b3f7a27d7a93cc510c11d72c4d15cbeb0126b2
-
SHA256
87eb366101783ff48590922bbcc5df97933f992605798bd0decfb1dfd9f32fe1
-
SHA512
4c9ac4cf174552e0780fc075b4c3d91bf62a07ce4ff0eb4eba51d3307885447189033089a2a397d71819458ded8028dcdfef5b12f785f1aac02463520c8836e3
-
SSDEEP
3072:EU2yjDZ7xKZCerbdsFOYxDDoLeQEC7TykBtwhJ:EKtxKZCNOYxDDoL48Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 22b62cd4195dc3a0d71bc63c4802c747_JaffaCakes118
Files
-
22b62cd4195dc3a0d71bc63c4802c747_JaffaCakes118.dll windows:4 windows x86 arch:x86
d11d6f3d04fde192fe2286495f188917
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
VirtualFree
CloseHandle
DeleteFileA
VirtualAlloc
CreateFileA
GetDiskFreeSpaceA
WriteFile
SetEndOfFile
SetFilePointer
FreeLibrary
FindClose
LoadLibraryA
FindFirstFileA
GetModuleFileNameA
InterlockedIncrement
SetThreadPriority
WaitForSingleObject
FindNextFileA
InterlockedDecrement
CreateDirectoryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetErrorMode
ExitProcess
GetProcAddress
user32
GetSystemMetrics
CharNextA
LoadStringA
wsprintfA
MessageBoxA
msvcr71
strncpy
strrchr
sprintf
free
malloc
_beginthread
strchr
??3@YAXPAX@Z
realloc
_stricmp
__security_error_handler
_except_handler3
__dllonexit
_onexit
_initterm
_adjust_fdiv
__CppXcptFilter
_splitpath
_putenv
??2@YAPAXI@Z
printf
Exports
Exports
MPACreateComponentInstance
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ