pdb.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3973358388922ad1ac6d7d6680678e79_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3973358388922ad1ac6d7d6680678e79_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3973358388922ad1ac6d7d6680678e79_JaffaCakes118
-
Size
92KB
-
MD5
3973358388922ad1ac6d7d6680678e79
-
SHA1
4cba0ba8bd386bd17571979a8f492c91d5f33a7a
-
SHA256
cd8d289a731ec72abe3fcff54952c81f1bdbfeb397e79b01729b3bf277c2fc22
-
SHA512
d0caf879363de0043f483a18138f9b2e4f7eb55b1096a58053c2d6adb2b57e9f9db6591f9b06090147c7f75f9dc12e8e5f2a488a0f25e1eb2f1d1e8221514bc3
-
SSDEEP
1536:DEpe3IwysT8jtb6x2TbAuSgUxBsxY0fC7E5ENQ:YuZwjtb6x6AuS3xBsxYBYEW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3973358388922ad1ac6d7d6680678e79_JaffaCakes118
Files
-
3973358388922ad1ac6d7d6680678e79_JaffaCakes118.dll windows:4 windows x86 arch:x86
4fcad3748b5122a42fe9ec2fbcf0f0a6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SetFilePointer
GetFileType
GetCurrentThreadId
GetLocaleInfoA
GetSystemInfo
TlsFree
UnmapViewOfFile
SetEndOfFile
GetStdHandle
GetEnvironmentVariableA
InterlockedExchange
lstrcmpA
EnterCriticalSection
MultiByteToWideChar
WriteFile
GetCPInfo
CreateThread
CreateFileA
LocalAlloc
HeapFree
GetTickCount
CreateMutexW
Sleep
IsDBCSLeadByte
DeleteCriticalSection
SetHandleCount
lstrlenW
HeapAlloc
TlsAlloc
VirtualAlloc
DeleteFileA
GetFullPathNameW
OpenFileMappingA
OpenFileMappingW
HeapDestroy
GetFullPathNameA
LocalFree
ReleaseMutex
lstrcmpiA
GetVersionExA
GetACP
GetLastError
VirtualQuery
FreeEnvironmentStringsA
lstrlenA
GetEnvironmentStringsW
GetProcAddress
LoadLibraryA
FreeLibrary
HeapReAlloc
FlushViewOfFile
CompareFileTime
SetUnhandledExceptionFilter
DeleteFileW
GetStringTypeW
GetDiskFreeSpaceW
LeaveCriticalSection
TerminateProcess
CloseHandle
MoveFileW
CreateEventA
GetFileSize
MoveFileA
SetFileTime
VirtualProtect
QueryPerformanceCounter
InitializeCriticalSection
WideCharToMultiByte
CreateFileMappingA
GetDiskFreeSpaceA
SetEvent
GetCurrentProcessId
MapViewOfFile
UnhandledExceptionFilter
InterlockedDecrement
TlsGetValue
CreateFileW
GetStringTypeExA
GetStringTypeA
DisableThreadLibraryCalls
HeapCreate
WaitForSingleObject
SetLastError
GetStartupInfoA
GetOEMCP
CreateMutexA
InterlockedIncrement
IsBadReadPtr
VirtualFree
InitializeCriticalSectionAndSpinCount
CreateFileMappingW
GetSystemTimeAsFileTime
GetCurrentProcess
LCMapStringA
GetEnvironmentStrings
FreeEnvironmentStringsW
EnumDateFormatsExA
Exports
Exports
twymq
Sections
.text Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 588B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ