H:\VoFilter\WebHijack\Release\websafe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
46bd6340f4e8ae22ccb23010a1e16507_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
46bd6340f4e8ae22ccb23010a1e16507_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
46bd6340f4e8ae22ccb23010a1e16507_JaffaCakes118
-
Size
113KB
-
MD5
46bd6340f4e8ae22ccb23010a1e16507
-
SHA1
c6e60d5ba8cd25fe84c75c2467bd5372f910b470
-
SHA256
7e64ed6af1c7bdf871d28dba716e43afdcd08857632e9f6ee41d86060e0df9d7
-
SHA512
8bfb9721aa8f32609f40b9540a84669d138b2f23e62e042cff42f09c8345de5db9206a07097b919218886443ec5f95049a8108c6482970f1d4464deeca8169fe
-
SSDEEP
1536:RpvawxlvPjQsw1xy8P3L1ARDsL4uKZzQdQ27lXIIOlIObnToIfIARs6v5C:brvPjR1yKtalXOv7TBfIARs6v5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46bd6340f4e8ae22ccb23010a1e16507_JaffaCakes118
Files
-
46bd6340f4e8ae22ccb23010a1e16507_JaffaCakes118.dll windows:5 windows x86 arch:x86
9183fd92322521495b3705c3409ebd45
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleHandleA
CloseHandle
GetFileSize
DeviceIoControl
GetCurrentDirectoryA
MoveFileA
FindClose
CopyFileA
GetProcAddress
GetLastError
FindFirstFileA
GetSystemDirectoryA
GetCurrentProcess
ReadFile
CreateFileA
HeapSize
MultiByteToWideChar
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringA
WideCharToMultiByte
LCMapStringW
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwind
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
user32
GetSystemMetrics
advapi32
AdjustTokenPrivileges
RegOpenKeyExA
LookupPrivilegeValueA
RegCreateKeyA
RegDeleteKeyA
RegSetValueExA
OpenProcessToken
RegSetValueA
RegCloseKey
Exports
Exports
InstallDriver
IsDriverRunning
LoadConfig
RemoveDriver
Sections
.text Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ