C:\src-branches\104\googleclient\talk\build\ext_opt\obj\clio\gtalkwmp\gtalkwmp1_dll.pdb
Static task
static1
Behavioral task
behavioral1
Sample
32a18bf5fd7930df553cccc129d383c6_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
32a18bf5fd7930df553cccc129d383c6_JaffaCakes118
-
Size
168KB
-
MD5
32a18bf5fd7930df553cccc129d383c6
-
SHA1
0794d7fd1f642e21d73b064f19549e61d296460f
-
SHA256
94ea876536ea36194762a856f6a6f74d3d4550fef4549569a77c33ec52dde6ef
-
SHA512
24a006a692c9205da18cc97de13de34505cefb7b98fcbab9d453f72b31c543058b341da43b60ed8b2825ee251f4f55522d039b215977bccfa17e115dedf32dad
-
SSDEEP
3072:dDxBZqV2evBMJlFIDNLGOj16YSwS2f4mV:LBV0Mpw6D0f7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32a18bf5fd7930df553cccc129d383c6_JaffaCakes118
Files
-
32a18bf5fd7930df553cccc129d383c6_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
09b4009ab39e5a5e4279f4e16a986352
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
HeapAlloc
GetProcessHeap
GetCurrentProcess
GetCurrentThread
WideCharToMultiByte
GetLongPathNameW
MultiByteToWideChar
lstrcpyW
GetModuleFileNameW
lstrcatW
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
lstrcpynW
GlobalUnlock
GlobalLock
FreeLibrary
SizeofResource
LoadResource
CloseHandle
LoadLibraryExW
GetModuleHandleW
GetCurrentThreadId
FlushInstructionCache
LCMapStringA
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetCPInfo
GetOEMCP
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapFree
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
FindResourceW
InterlockedExchange
GetTickCount
GetSystemInfo
VirtualProtect
QueryPerformanceCounter
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetVersionExA
HeapReAlloc
GetCommandLineA
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
RtlUnwind
VirtualQuery
GetProcAddress
GetModuleHandleA
TerminateProcess
HeapSize
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
LCMapStringW
user32
RegisterClassExW
LoadCursorW
wsprintfW
CreateWindowExW
DestroyWindow
SendMessageW
CallWindowProcW
GetWindowLongW
SetWindowLongW
DefWindowProcW
UnregisterClassW
CharNextW
GetClassInfoExW
advapi32
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryInfoKeyW
OpenThreadToken
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegEnumKeyExW
ole32
CreateStreamOnHGlobal
GetHGlobalFromStream
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
oleaut32
SysAllocString
SysStringByteLen
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysFreeString
shlwapi
PathFindExtensionW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetShortcutTargetPath
IsIntegrityLevelHigh
Sections
.text Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE