d:\업무관련\funmarket\1006_funpopup_교체\03-\Funpop\Release\Funpop.pdb
Static task
static1
Behavioral task
behavioral1
Sample
373f2638b99b80473b4566b2ac07f873_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
373f2638b99b80473b4566b2ac07f873_JaffaCakes118
-
Size
152KB
-
MD5
373f2638b99b80473b4566b2ac07f873
-
SHA1
98cfa9cb63a816f89063cc6ed89f4373f4e4bf82
-
SHA256
96b8ec07a47b916603feed265ae74a70b90c1d78dea24d5edce965aac628a7da
-
SHA512
4734d680a3b917c1049a8724a9b83f465385dc47a8c8ecb91fdcef88d6700f0eb953cece9f4047885018d99cfbd704235754bbbde41f3434b924d867e4b4230b
-
SSDEEP
1536:dTf/d3kZ6GwjNO5hREj8wrfMAPhHLC/QitFpyWZCbowMRksfQrlCMzMyDAQgK9:dTfFmZhRIFp5HzpM9MzMyUQgK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 373f2638b99b80473b4566b2ac07f873_JaffaCakes118
Files
-
373f2638b99b80473b4566b2ac07f873_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
c932b6d0d6f2c3e1a86c833f691ef193
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
wininet
InternetReadFile
InternetQueryDataAvailable
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetCloseHandle
urlmon
URLDownloadToFileA
kernel32
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrlenA
lstrcmpiA
GetModuleFileNameA
IsDBCSLeadByte
InterlockedIncrement
InterlockedDecrement
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
SetThreadLocale
GetThreadLocale
GetVersionExA
GetConsoleCP
DebugBreak
OutputDebugStringA
CloseHandle
ReadFile
CreateFileA
GetLocalTime
ExpandEnvironmentStringsA
GetProcAddress
LoadLibraryW
InterlockedExchange
lstrlenW
GetLocaleInfoA
GetConsoleMode
SetFilePointer
WideCharToMultiByte
MultiByteToWideChar
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
LCMapStringW
LCMapStringA
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetStringTypeW
GetStringTypeA
IsValidCodePage
GetOEMCP
GetCPInfo
Sleep
HeapSize
SetLastError
GetACP
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetProcessHeap
VirtualFree
HeapDestroy
HeapCreate
ExitProcess
WriteFile
GetStdHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetEnvironmentStrings
user32
CharNextA
LoadStringA
SetWindowPos
GetSystemMetrics
CharLowerA
UnregisterClassA
advapi32
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
ole32
CoTaskMemRealloc
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
shell32
ord680
SHGetSpecialFolderPathA
ShellExecuteA
oleaut32
LoadRegTypeLi
SysAllocStringLen
VariantChangeType
VariantCopy
VariantClear
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen
iphlpapi
GetAdaptersInfo
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 104KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ