C:\build\source\filesystem\http\rel32\httpfsys.pdb
Static task
static1
Behavioral task
behavioral1
Sample
447beb95dae8150242130068fc5489fd_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
447beb95dae8150242130068fc5489fd_JaffaCakes118
-
Size
328KB
-
MD5
447beb95dae8150242130068fc5489fd
-
SHA1
4d07f5e9f2e313ae811e79fcb8cf08e57e0005f5
-
SHA256
fc76cbd2c7c28f98c7c796baed5e63e8ac1e07143c87381620e625ecda3a85b3
-
SHA512
a233773d3da7267d8914869b64948fc19722fed68fa07f63732dce5d898e97bb60a906b79b2caf1dc723760deae777e4dac3182f904166deae8ab9a70c4ef6b5
-
SSDEEP
6144:1d98Fks7i4Jwb8WbcRoEQJxvWqFFl00rOy+IBiiRX7MSkECHMjC3llvU:1d98Gs+4Jwb8WbcRoEQJ1V60xRrqECHy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 447beb95dae8150242130068fc5489fd_JaffaCakes118
Files
-
447beb95dae8150242130068fc5489fd_JaffaCakes118.dll windows:5 windows x86 arch:x86
8752e0cc03358613447ff6367c93ef62
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleFileNameA
GetModuleHandleA
GetDiskFreeSpaceA
FreeLibrary
GetProcAddress
LoadLibraryA
WaitForSingleObject
CreateMutexA
ReleaseMutex
CloseHandle
DeleteFileA
FindClose
GetWindowsDirectoryA
CreateDirectoryA
FindFirstFileA
GetDriveTypeA
RemoveDirectoryA
SetFileAttributesA
GetFileAttributesA
FindNextFileA
MoveFileA
GetSystemInfo
UnmapViewOfFile
GetLastError
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
GetTempFileNameA
GetTempPathA
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
LocalFileTimeToFileTime
GetCurrentProcessId
GetCurrentThreadId
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
user32
CharNextA
GetSystemMetrics
CharPrevA
msvcr90
atol
memcpy
??_U@YAPAXI@Z
strncpy
strncmp
sscanf
free
strtol
sprintf
memmove
fclose
fwrite
fopen
remove
_localtime32
calloc
fflush
malloc
strspn
fread
_time32
asctime
isspace
strchr
iscntrl
getenv
strtok
_errno
_fstat32
_chsize
_findfirst32
_findnext32
_findclose
strncat
_vsnprintf
tolower
isupper
memset
strtoul
isdigit
isalnum
islower
isxdigit
isalpha
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
atoi
??_V@YAXPAX@Z
_purecall
_stat32
_strnicmp
_stricmp
strstr
strrchr
??2@YAPAXI@Z
??3@YAXPAX@Z
_lseek
_tell
_read
_write
fprintf
_unlink
_getcwd
_chdir
_close
_creat
_open
_sopen
Exports
Exports
CanUnload
RMACreateInstance
RMAShutdown
Sections
.text Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 147KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE