d:\MyWorks\套马专用\森马\dllbak\Release\NFPD.pdb
Static task
static1
Behavioral task
behavioral1
Sample
28c3d8781942b4985729fffc36664a26_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
28c3d8781942b4985729fffc36664a26_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
28c3d8781942b4985729fffc36664a26_JaffaCakes118
-
Size
23KB
-
MD5
28c3d8781942b4985729fffc36664a26
-
SHA1
8788d66e1963d9bf5013704b77128a3dbf6ff2be
-
SHA256
7d3f034c48a551057f60549f24d99a711cb3bb6419faac571d6017d214d57f34
-
SHA512
8aa81c22a3f9c0ec0a3da18e59e7a9450e8e4264365046873bcb56716bfa8578369cae2853b8226563bd699da965fe1e997928e29b118b7948e75774a5c2920a
-
SSDEEP
384:E+nWybgUqkBQbcdMTzzM049SM7MEK6LaZsb09VD/fTOce:MF7l3nzG9OEKMTWD3T5e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28c3d8781942b4985729fffc36664a26_JaffaCakes118
Files
-
28c3d8781942b4985729fffc36664a26_JaffaCakes118.dll windows:4 windows x86 arch:x86
e2de6920e75df2daba2efcbd8a12c859
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateThread
lstrcpynA
CopyFileA
GetSystemDirectoryA
FreeLibrary
IsBadReadPtr
CreateToolhelp32Snapshot
Process32First
Process32Next
Sleep
GetLastError
TerminateProcess
OpenProcess
lstrcmpA
GetTickCount
MultiByteToWideChar
DeleteFileA
WritePrivateProfileStringA
GlobalAlloc
GlobalLock
WriteFile
GlobalUnlock
GlobalFree
GetSystemTime
CreateMutexA
lstrcmpiA
GetModuleFileNameA
lstrlenA
GetModuleHandleA
CloseHandle
lstrcpyA
ReadFile
SetFilePointer
CreateFileA
lstrcatA
GetTempPathA
VirtualProtect
LoadLibraryA
GetPrivateProfileStringA
GetProcAddress
user32
GetSystemMetrics
IsRectEmpty
GetDC
FindWindowA
PostThreadMessageA
GetWindowTextA
SetWindowsHookExA
CallNextHookEx
ReleaseDC
gdi32
CreateDCA
GetObjectA
SelectPalette
RealizePalette
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteDC
GetDIBits
GetStockObject
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
msvcrt
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
malloc
free
memmove
??1type_info@@UAE@XZ
memset
strstr
gdiplus
GdiplusShutdown
GdipDisposeImage
GdiplusStartup
GdipGetImageEncoders
GdipAlloc
GdipSaveImageToFile
GdipCloneImage
GdipLoadImageFromFile
GdipFree
GdipGetImageEncodersSize
wininet
InternetOpenA
InternetCloseHandle
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
Exports
Exports
COMResModuleInstance
VVVV
YYYY
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ