dbghelp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2572aaf42369bdfe308103997bbf9c04_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2572aaf42369bdfe308103997bbf9c04_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
2572aaf42369bdfe308103997bbf9c04_JaffaCakes118
-
Size
874KB
-
MD5
2572aaf42369bdfe308103997bbf9c04
-
SHA1
075436eaec884acb7b7875a29b1cc995a7d7ef48
-
SHA256
7a265bf6e1e2f41b444c1b12a37bb0040de38babbcba1eda1e4d394166745f20
-
SHA512
cd1a38b3292735b490079db9d915f427a86fd9044eb1aa7af0a2f008a00062cabadb9834e31dba64b615a49a0c893dfcbaebff4ee21d20a4f74fe04698fd8fe9
-
SSDEEP
12288:5f2Mj6SpI4mdXQWabrPCFaVTL+dBWJo76/tU8x4bGA9EuGzOmXrefN9x:576Y9kVaiaTCdBco76me6GA9EuGy9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2572aaf42369bdfe308103997bbf9c04_JaffaCakes118
Files
-
2572aaf42369bdfe308103997bbf9c04_JaffaCakes118.dll windows:6 windows x86 arch:x86
425b64334ee18e882811879422b116dd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetProcAddress
DeleteFileA
CreateDirectoryA
GetModuleFileNameA
ExpandEnvironmentStringsA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
UnmapViewOfFile
GetFullPathNameA
GetFileAttributesA
SetFilePointer
FindClose
VirtualProtect
VirtualAlloc
DuplicateHandle
MapViewOfFile
CreateFileMappingA
GetModuleHandleA
OpenProcess
GetCurrentProcessId
VirtualFree
ReadProcessMemory
WriteFile
DeleteFileW
CreateFileW
SetErrorMode
DebugBreak
GetSystemDirectoryA
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
FreeLibrary
OutputDebugStringA
lstrlenA
IsDBCSLeadByte
HeapFree
HeapAlloc
HeapReAlloc
TlsFree
TlsAlloc
GetVersionExA
InitializeCriticalSection
FlushViewOfFile
MapViewOfFileEx
GetFileType
CreateFileMappingW
DeviceIoControl
ExpandEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
LCMapStringW
LCMapStringA
CopyFileA
SetFileAttributesA
CopyFileW
GetFileAttributesW
SetFileAttributesW
InterlockedIncrement
InterlockedDecrement
Sleep
FormatMessageA
GetThreadSelectorEntry
CreateThread
TerminateThread
LoadLibraryW
VirtualQueryEx
GetPriorityClass
GetThreadPriority
GetThreadTimes
GetThreadContext
ResumeThread
HeapCreate
DeleteCriticalSection
LocalFree
HeapDestroy
TlsGetValue
TlsSetValue
GetLastError
CreateFileA
GetFileSize
ReadFile
CloseHandle
EnterCriticalSection
LeaveCriticalSection
LocalAlloc
FindFirstFileA
FindNextFileA
SetLastError
GetEnvironmentVariableA
GetSystemInfo
GetVersionExW
SuspendThread
msvcrt
__dllonexit
_adjust_fdiv
_initterm
_wcsnicmp
isprint
_vsnwprintf
memmove
calloc
wcscat
strncat
_itoa
_vsnprintf
_write
strncpy
_strcmpi
strrchr
tolower
_close
_open
time
wcsncpy
_ltoa
_strnicmp
vsprintf
_stricmp
isspace
ctime
malloc
_strlwr
free
__CxxFrameHandler
fclose
_wcsicmp
_onexit
wcscmp
wcsncmp
_wsplitpath
towlower
__unDName
_CxxThrowException
bsearch
_snwprintf
fread
fseek
_wfopen
fopen
_osver
wcstol
wcsrchr
_wmakepath
wcscpy
_winminor
_winmajor
_wcsdup
ftell
_wgetenv
_mbsicmp
_fullpath
_access
_fsopen
_wfsopen
_sopen
_wsopen
_wfullpath
_get_osfhandle
_read
_lseeki64
_chsize
_open_osfhandle
_mbscmp
_memicmp
_mbsnbcpy
??1type_info@@UAE@XZ
?terminate@@YAXXZ
sprintf
_except_handler3
wcslen
qsort
strchr
strstr
strncmp
isxdigit
??2@YAPAXI@Z
??3@YAXPAX@Z
_splitpath
_purecall
atol
advapi32
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
rpcrt4
UuidCreate
Exports
Exports
DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumerateLoadedModules
EnumerateLoadedModules64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindExecutableImage
FindExecutableImageEx
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
StackWalk
StackWalk64
SymAddSymbol
SymCleanup
SymDeleteSymbol
SymEnumLines
SymEnumSourceFiles
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumTypes
SymEnumerateModules
SymEnumerateModules64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindFileInPath
SymFromAddr
SymFromIndex
SymFromName
SymFromToken
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromName
SymGetLineFromName64
SymGetLineNext
SymGetLineNext64
SymGetLinePrev
SymGetLinePrev64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOptions
SymGetScope
SymGetSearchPath
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileToken
SymGetSourceVarFromToken
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetTypeFromName
SymGetTypeInfo
SymInitialize
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymMatchFileName
SymMatchString
SymMatchStringW
SymNext
SymPrev
SymRegisterCallback
SymRegisterCallback64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSetContext
SymSetHomeDirectory
SymSetOptions
SymSetParentWindow
SymSetSearchPath
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnmapDebugInformation
WinDbgExtensionDllInit
dbghelp
dh
fptr
lm
lmi
omap
srcfiles
stackdbg
sym
symsrv
vc7fpo
Sections
.text Size: 733KB - Virtual size: 732KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 90KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ