d:\推广专用\www\DLL\TS-6D\release\qibho.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3a313a9f54216e5c210ddf66771d22f5_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
3a313a9f54216e5c210ddf66771d22f5_JaffaCakes118
-
Size
240KB
-
MD5
3a313a9f54216e5c210ddf66771d22f5
-
SHA1
785fef9f1a22d9d9814f3e73b111710b238726f5
-
SHA256
1708bb7e9819d398b6f7766b3fafd9d5ab8115e3ceb45db61dfe20f5f8155f17
-
SHA512
239fc506eaf0a117bf0be4668a09dd75557374e68749365ae2fc97303b54846c39fbbd62014121f74e21984b4c2d58231bca348c1501a4ec10911b57c5091e84
-
SSDEEP
3072:Ihr3wVo8i/xN6j/fkKIcCKRqTc9ShIWvSzwc3F9XNe/NBn+xStFIGaBWHE:IhMVPUxN6L8xczShoVXNeaxOBaQHE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a313a9f54216e5c210ddf66771d22f5_JaffaCakes118
Files
-
3a313a9f54216e5c210ddf66771d22f5_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
a9a3199e9fb2fe22a7ebbf8e7ec9e547
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
MultiByteToWideChar
lstrlenA
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetTickCount
GetTempFileNameA
GetTempPathA
CloseHandle
CreateFileW
ReadFile
GetFileSize
WideCharToMultiByte
DeleteFileA
GetPrivateProfileIntA
CopyFileA
CopyFileW
DeleteFileW
VirtualProtect
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetModuleFileNameA
WaitForSingleObject
SetEvent
lstrcmpiW
CreateThread
CreateEventW
Sleep
IsBadReadPtr
GetThreadLocale
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
CreateFileA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FindResourceExW
lstrlenW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
ResetEvent
InterlockedExchange
SetFilePointer
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
HeapCreate
HeapDestroy
VirtualAlloc
VirtualFree
GetProcessHeap
GetVersionExA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
LCMapStringW
LCMapStringA
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetACP
GetCPInfo
GetStdHandle
LoadLibraryW
lstrcpyW
lstrcatA
DeviceIoControl
GetSystemWindowsDirectoryW
lstrcpyA
GetVersionExW
HeapAlloc
HeapFree
HeapReAlloc
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
ExitThread
GetCurrentThreadId
WriteFile
user32
FindWindowExW
CharNextW
wsprintfW
EnumChildWindows
GetParent
UnregisterClassA
GetClassNameA
RemovePropW
SetPropW
PostMessageW
wsprintfA
SendMessageW
DefWindowProcA
DefWindowProcW
GetWindowTextLengthW
GetWindowTextW
GetFocus
GetWindowTextA
SetWindowTextW
IsWindowVisible
GetPropW
IsWindowUnicode
SetWindowLongW
SetWindowLongA
CallWindowProcW
CallWindowProcA
advapi32
RegDeleteValueW
RegOpenKeyExA
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW
ole32
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoGetMalloc
StringFromIID
oleaut32
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
VariantClear
SysFreeString
shlwapi
SHSetValueA
SHDeleteKeyA
SHDeleteKeyW
SHSetValueW
SHGetValueA
urlmon
URLDownloadToFileA
wininet
InternetCloseHandle
InternetReadFile
InternetOpenW
InternetOpenUrlW
InternetSetOptionW
iphlpapi
GetAdaptersInfo
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 176KB - Virtual size: 175KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ