e:\backgroundoperation\source\assistanceproject\backoperhelper\output\BackOperHelper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3e0c5c8ea4a42e4859146bb825ce2f4e_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3e0c5c8ea4a42e4859146bb825ce2f4e_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3e0c5c8ea4a42e4859146bb825ce2f4e_JaffaCakes118
-
Size
108KB
-
MD5
3e0c5c8ea4a42e4859146bb825ce2f4e
-
SHA1
390cd141da99b56b70be13622a4edad8e43b97bb
-
SHA256
101dd50b38f8e728744a1784698adee8922ee770d6ef0b5f2b8a31891205adc9
-
SHA512
8a84d81868692b4e902e25d2b8bda01ec197b004d59801485737f98add0eb7a9188f24dd3d668da6601ae1f973c53846b0753e273afb194b0d63d59ec608b619
-
SSDEEP
1536:fx/us1Vs0bS/5esRqeoknbeLo+M3VcOU0z8yP2EUQEQBtiBLO:pWsTsNjF8EUQEQBto6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e0c5c8ea4a42e4859146bb825ce2f4e_JaffaCakes118
Files
-
3e0c5c8ea4a42e4859146bb825ce2f4e_JaffaCakes118.dll windows:4 windows x86 arch:x86
3e4c08c52a2bb19ee14109f55fdca2cb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetLastError
CloseHandle
FindFirstFileA
SearchPathA
GetFileSize
DeleteFileA
GetEnvironmentVariableA
SetFileAttributesA
CreateFileA
GetWindowsDirectoryA
Sleep
DeviceIoControl
GetLocalTime
SystemTimeToFileTime
GetTickCount
GetShortPathNameA
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
FindClose
FindNextFileW
DeleteFileW
FreeLibrary
GetProcAddress
LoadLibraryW
FindFirstFileW
GetWindowsDirectoryW
GetModuleFileNameW
GlobalFree
CopyFileA
lstrcpyW
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetCommandLineA
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
GetCPInfo
GetOEMCP
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
WriteFile
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
advapi32
QueryServiceStatus
StartServiceW
ChangeServiceConfigW
RegOpenKeyA
OpenSCManagerW
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyExA
CreateServiceA
CloseServiceHandle
StartServiceA
OpenServiceA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegCreateKeyA
GetUserNameA
shell32
ShellExecuteW
ole32
CoInitialize
CoUninitialize
CoCreateInstance
user32
UnregisterClassA
Exports
Exports
CloseExistedDll
CloseExistedDllByRundll32
CreateTask
Install
Uninstall
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ