f:\sandbox\20071220_095411\enc_wma\Profiling\enc_wma.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4936fdd4cf613bf533ba3a11a96d2d17_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4936fdd4cf613bf533ba3a11a96d2d17_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4936fdd4cf613bf533ba3a11a96d2d17_JaffaCakes118
-
Size
161KB
-
MD5
4936fdd4cf613bf533ba3a11a96d2d17
-
SHA1
c49fd5ad828272df0ecccf7ca2ee050290c20b76
-
SHA256
35e72088445a7920f1945aea3e841128c2115b7db3900b2217ac51da3268cffa
-
SHA512
57bf011902a7ae1efcb0d145571c18069dbbe26129023cf1fc8b2a4acadfc770288075322f29e38f17e6bb5c5bb6a06d98a21c6cb3e76ff3e47a8aec1f608865
-
SSDEEP
3072:Dswj5qem9FZ9a5VYYuQ7G3BNWG4V2texaoLD26rfeNBt3x8P/:FfWcVYu78BNHI2teEov3rfAny3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4936fdd4cf613bf533ba3a11a96d2d17_JaffaCakes118
Files
-
4936fdd4cf613bf533ba3a11a96d2d17_JaffaCakes118.dll windows:4 windows x86 arch:x86
b98ef65f6e57de3e4591bf1c77489070
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
wmvcore
WMCreateWriter
WMCreateWriterFileSink
WMCreateIndexer
WMCreateProfileManager
kernel32
lstrcpynA
VirtualQuery
WritePrivateProfileStructW
WideCharToMultiByte
MultiByteToWideChar
GetPrivateProfileStructW
SetEvent
MoveFileW
DeleteFileW
CloseHandle
WaitForSingleObject
CreateEventA
GetTempFileNameW
GetTempPathW
GetPrivateProfileStructA
WritePrivateProfileStructA
lstrcmpiA
user32
SendMessageA
SetWindowLongA
GetWindowLongA
SetDlgItemTextA
SendDlgItemMessageA
wsprintfA
MessageBoxA
nscrt
_vsnprintf
??2@YAPAXI@Z
wcscpy
_strdup
calloc
strstr
??_V@YAXPAX@Z
??_U@YAPAXI@Z
__CxxFrameHandler
malloc
free
??3@YAXPAX@Z
_purecall
Exports
Exports
ConfigAudio3
CreateAudio3
FinishAudio3
GetAudioTypes3
GetConfigItem
PrepareToFinish
SetConfigItem
SetWinampHWND
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 714B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 145KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE