d:\Works\KernelBots_Up19\Shell\Release\Shell.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2f92ca0d5053fce2dd6f62804bd1fcf7_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2f92ca0d5053fce2dd6f62804bd1fcf7_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2f92ca0d5053fce2dd6f62804bd1fcf7_JaffaCakes118
-
Size
192KB
-
MD5
2f92ca0d5053fce2dd6f62804bd1fcf7
-
SHA1
826dc57dbc733ef3807f5be6347785c739557133
-
SHA256
9418c7b924dda6d99470dcb633d099a0f876da353cd9c67334512b0ab9db016b
-
SHA512
d995030013479cabd63fcbc2fa86a7e58c27c0f0b2a7801348a13c52f335d7331af78f7159887feaeb8cee76b36fb00c8e14ad0a60ed8a473cc09dad2ea4a169
-
SSDEEP
3072:3HOqxpgEcQ42Wtiyh7b6BFoeN1l8dxOR:XbgEcQ420iyh72BFotdM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f92ca0d5053fce2dd6f62804bd1fcf7_JaffaCakes118
Files
-
2f92ca0d5053fce2dd6f62804bd1fcf7_JaffaCakes118.dll windows:4 windows x86 arch:x86
166a5331c98ab70aadc4332be050f20c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ws2_32
inet_ntoa
htonl
closesocket
select
setsockopt
WSACleanup
sendto
WSAStartup
send
socket
inet_addr
htons
connect
gethostbyname
wininet
InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenW
kernel32
HeapAlloc
VirtualProtect
HeapFree
Sleep
lstrlenW
CreateThread
lstrcpyW
WideCharToMultiByte
GetTickCount
GetVersionExW
InterlockedExchange
GetACP
GetLocaleInfoA
InitializeCriticalSection
DeleteCriticalSection
lstrcatW
GetProcAddress
GetModuleHandleW
GlobalFree
GlobalAlloc
CreateFileW
GetModuleFileNameW
GetModuleFileNameA
GetSystemDirectoryW
OpenFile
CloseHandle
GetLastError
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
CreateProcessW
CopyFileW
DeleteFileW
LoadLibraryW
FindClose
FindNextFileW
GetFullPathNameW
FindFirstFileW
SetCurrentDirectoryW
SetFileAttributesW
Process32NextW
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
GetPrivateProfileStringW
DeviceIoControl
GetCurrentProcess
GetExitCodeThread
WaitForSingleObject
VirtualFree
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
TerminateProcess
GetCurrentThreadId
SetFilePointer
ReadFile
SetFileTime
GetFileSize
GetFileTime
DuplicateHandle
GetTempPathW
ExitProcess
RtlUnwind
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetSystemTimeAsFileTime
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
HeapDestroy
HeapCreate
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
WriteFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
GetOEMCP
SetStdHandle
FlushFileBuffers
GetSystemInfo
SetEndOfFile
VirtualQuery
user32
ShowWindow
CreateWindowExW
RegisterClassExW
wsprintfW
UpdateWindow
DispatchMessageW
TranslateMessage
DefWindowProcW
PostQuitMessage
SetWindowLongW
GetClientRect
GetWindowLongW
GetMessageW
advapi32
ControlService
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegCreateKeyW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteValueW
CreateServiceW
RegOpenKeyExW
RegSetValueExW
ChangeServiceConfigW
ole32
CoGetClassObject
OleSetContainedObject
OleInitialize
oleaut32
VariantClear
SysAllocString
VariantInit
shlwapi
PathRemoveFileSpecW
psapi
GetModuleFileNameExW
GetModuleBaseNameW
Exports
Exports
DestoryAntiVirus
GetDllModuleControlInit
StartShell
StartShell_A
StartShell_B
StartShell_C
StartShell_D
Sections
.text Size: 112KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Shell__ Size: 4KB - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ