C:\Documents and Settings\Administrator\桌面\纠错:3个同启就封IP版(也是间隔3秒,和“3秒版”共用一个Shua.txt)\多线程试验用\Start\Release\Start.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3ba125fa0348328f29c17786c504133d_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3ba125fa0348328f29c17786c504133d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3ba125fa0348328f29c17786c504133d_JaffaCakes118
-
Size
155KB
-
MD5
3ba125fa0348328f29c17786c504133d
-
SHA1
cae5b95f577b515e43abc16363b0e04383348078
-
SHA256
4de7bb4cd27acde6f35fbcccadfe288a66e015072fb8b73f8f9f5e816f4934e5
-
SHA512
c3a6413e3f71c009e7f79948c8d30800627ca2c3724636a5cdf524b311d79ba851b8299c69ebe76809783302b8c91c7e84252697122c66d368250d7ec60ac5d3
-
SSDEEP
3072:MFBhfPm9Q0flwwdSbthEBBCIE/KQB6Tyx04ac/o994:MFDfyfl18twRytjM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ba125fa0348328f29c17786c504133d_JaffaCakes118
Files
-
3ba125fa0348328f29c17786c504133d_JaffaCakes118.dll windows:5 windows x86 arch:x86
f33fede106a4fcfef0400257f174edf2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
MoveFileW
CloseHandle
DeleteFileW
GetLastError
CreateProcessW
GetFileAttributesW
DisableThreadLibraryCalls
FreeLibraryAndExitThread
CreateFileW
GetModuleFileNameW
Sleep
GetSystemDirectoryW
WriteFile
GetProcessHeap
GetTickCount
GetModuleHandleW
HeapFree
CreateThread
HeapAlloc
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetCPInfo
RtlUnwind
RaiseException
LCMapStringW
LCMapStringA
GetStringTypeW
GetACP
GetOEMCP
IsValidCodePage
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetModuleHandleA
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryA
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
LocalAlloc
advapi32
RegCloseKey
ControlService
QueryServiceStatusEx
RegOpenKeyW
RegQueryValueExW
RegCreateKeyW
OpenServiceW
EnumDependentServicesW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
Sections
.text Size: 118KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ