recuiva.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2dc44be5045f4ca41873f6b7d82e3d6b_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2dc44be5045f4ca41873f6b7d82e3d6b_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2dc44be5045f4ca41873f6b7d82e3d6b_JaffaCakes118
-
Size
622KB
-
MD5
2dc44be5045f4ca41873f6b7d82e3d6b
-
SHA1
2ddc593226e6b6010888dde522db4907e8365d07
-
SHA256
f12fb24947fca67b9f2a4b203d2d978a91557ebacf73070b971525ec8ffc7d11
-
SHA512
c15338229f8da6d5f0cf1b1dce2283d8dda8b78a2a0c9ec74d9436b4d87f5b9640142139b6e7f38edbc3d6f2937fbd757e7daf1a3e8d36cc6ec9c2e0cffceefe
-
SSDEEP
6144:LR2Bx9ybAzQw+ZzNLXdALF5UAqVgnefNyOY1rGpadAadP9fHO3gfiS4EOTv:QxiAAZpdyFFq2n1OY1apQ43Q4EC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dc44be5045f4ca41873f6b7d82e3d6b_JaffaCakes118
Files
-
2dc44be5045f4ca41873f6b7d82e3d6b_JaffaCakes118.dll windows:4 windows x86 arch:x86
11ac2b66d60bf8f371750c0d14b89155
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FreeEnvironmentStringsA
LeaveCriticalSection
SetLastError
GetCurrentThreadId
ConnectNamedPipe
WaitForMultipleObjects
HeapAlloc
LCMapStringA
IsBadReadPtr
GetVersionExA
InitializeCriticalSection
ResetEvent
lstrcatW
HeapFree
GetSystemInfo
DeleteCriticalSection
WaitForSingleObject
DuplicateHandle
GetStdHandle
EnterCriticalSection
GetLocaleInfoA
LoadLibraryA
GetLastError
GetCPInfo
IsBadCodePtr
CreateTimerQueueTimer
GetOEMCP
WriteFile
GetModuleHandleA
SetUnhandledExceptionFilter
QueryPerformanceCounter
UnhandledExceptionFilter
GetStartupInfoA
GetEnvironmentStringsW
CreateNamedPipeA
GetACP
OpenProcess
SetEvent
ReleaseMutex
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchangeAdd
WideCharToMultiByte
GetTickCount
UnmapViewOfFile
RtlUnwind
FreeEnvironmentStringsW
InterlockedExchange
MultiByteToWideChar
HeapDestroy
GetEnvironmentStrings
GetFileType
InterlockedCompareExchange
IsBadWritePtr
lstrcpyW
InterlockedDecrement
CreateMutexW
GetModuleFileNameA
LCMapStringW
ExitThread
GetBinaryTypeA
DisconnectNamedPipe
TerminateProcess
CreateEventA
DeleteTimerQueueTimer
user32
wsprintfW
LoadIconA
DrawIcon
CreateIconFromResource
advapi32
InitializeSecurityDescriptor
GetUserNameA
SetSecurityDescriptorDacl
msvcrt
_stricmp
_wtoi
_wcsnset
fflush
vwprintf
_strnicmp
memset
towupper
wcstol
wcsstr
_ltow
wcscmp
printf
wcstod
strtok
wprintf
calloc
memcpy
wcscpy
wcslen
realloc
fprintf
wcscat
fgetws
wcsncmp
malloc
memmove
wcschr
isdigit
swprintf
scanf
free
wcstok
exit
Exports
Exports
taxa
Sections
.text Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 552KB - Virtual size: 582KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ