P:\mtgenbvpGdhta\ALmdfcghZLvek\AragKnptai.pdb
Static task
static1
Behavioral task
behavioral1
Sample
49a4264ca9612c3ee3f10bfbef13eeea_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
49a4264ca9612c3ee3f10bfbef13eeea_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
49a4264ca9612c3ee3f10bfbef13eeea_JaffaCakes118
-
Size
227KB
-
MD5
49a4264ca9612c3ee3f10bfbef13eeea
-
SHA1
5b1f7f1850ebb364d1fbeba2208a323f76db6a13
-
SHA256
08e75249facc89310e17d371de21f691977677546136ce0ce7ae13ff65524e6e
-
SHA512
08662f23127e5520840e37c6479f3801ed886e0d217ab71812217c1d4e7ce257d2c047c13488e6f65eb8041e21919f325affee08c62ed1b90788ed7031aed5e1
-
SSDEEP
6144:dz6ZaxnqgOe4L4Ah9jQk7O4YXuueW/t+XG3I3:dWOqgOeoffFY+u7/tr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49a4264ca9612c3ee3f10bfbef13eeea_JaffaCakes118
Files
-
49a4264ca9612c3ee3f10bfbef13eeea_JaffaCakes118.dll windows:5 windows x86 arch:x86
3a19f906be794bf4d9d371863a7a6a0c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
gdi32
ExtTextOutA
GetNearestColor
SetDIBits
GetWindowOrgEx
AddFontResourceW
OffsetRgn
ScaleWindowExtEx
UnrealizeObject
CreateDIBitmap
CreateFontIndirectA
CreateFontW
GetTextCharsetInfo
SetLayout
CreateRoundRectRgn
GetTextMetricsA
SetWindowOrgEx
GetTextAlign
RestoreDC
RemoveFontResourceW
DeleteObject
Ellipse
IntersectClipRect
WidenPath
PatBlt
SetPaletteEntries
ScaleViewportExtEx
Escape
CreatePolygonRgn
GetFontData
PathToRegion
ExtTextOutW
CreatePalette
GetPaletteEntries
RoundRect
GetViewportOrgEx
SetBitmapDimensionEx
EndPath
RectVisible
SetAbortProc
GetTextExtentPoint32A
SetWindowExtEx
CreateBitmap
Polyline
CreatePenIndirect
comctl32
ImageList_Remove
CreatePropertySheetPageA
CreateStatusWindowW
ImageList_Destroy
PropertySheetA
ImageList_Write
user32
HideCaret
RemovePropW
GetDC
IsCharLowerA
CopyRect
ExitWindowsEx
GetWindowTextW
DefFrameProcW
MonitorFromRect
GetWindowPlacement
GetWindowDC
SwitchToThisWindow
GetMenuCheckMarkDimensions
GetShellWindow
CharLowerA
SetCursorPos
DestroyMenu
EqualRect
PostThreadMessageW
GetDlgItemTextW
WindowFromPoint
GetDlgCtrlID
GetClassLongW
GetTopWindow
CharPrevW
LoadIconA
VkKeyScanW
SetWindowRgn
CopyAcceleratorTableW
TabbedTextOutW
IsDialogMessageW
ChildWindowFromPoint
CharUpperBuffA
SetWindowTextW
LoadAcceleratorsA
CreateWindowExW
DialogBoxParamW
FillRect
ModifyMenuW
GetDlgItemTextA
DrawIconEx
MapVirtualKeyW
ScreenToClient
OpenDesktopW
IsWindowEnabled
SetMenuDefaultItem
IsWindowUnicode
GetSubMenu
SendDlgItemMessageA
MessageBoxExW
DialogBoxIndirectParamA
CharLowerW
SendDlgItemMessageW
IsRectEmpty
GetMenuItemID
CharToOemA
DestroyWindow
GetSysColor
MoveWindow
wvsprintfW
OpenIcon
GetIconInfo
SetWindowPlacement
GetMessageA
GetMessageW
PtInRect
GetMenuItemCount
TranslateMessage
PostThreadMessageA
GetWindowTextA
GetClassInfoA
CreateDialogParamA
CreateCaret
GetSysColorBrush
MapVirtualKeyA
GetMenuItemRect
PeekMessageA
SetLastErrorEx
UpdateWindow
GetParent
FindWindowExA
GetCursorPos
InternalGetWindowText
GetSystemMenu
DialogBoxIndirectParamW
SetTimer
GetKeyState
OemToCharA
EndPaint
LoadMenuA
GetNextDlgGroupItem
GetKeyboardLayoutList
CharNextW
GetUserObjectInformationW
SetScrollRange
WaitMessage
SystemParametersInfoA
SetPropW
GrayStringW
GetLastActivePopup
OpenInputDesktop
IsCharUpperA
SendMessageA
GetDCEx
GetScrollPos
RegisterWindowMessageA
LookupIconIdFromDirectory
DrawEdge
SetScrollPos
msvcrt
iswalpha
strstr
strpbrk
tolower
malloc
wcsncpy
sscanf
_controlfp
__set_app_type
vsprintf
floor
__p__fmode
fprintf
vswprintf
toupper
fseek
islower
__p__commode
getc
strspn
_amsg_exit
wcstoul
_initterm
iswspace
_acmdln
ftell
exit
_ismbblead
strtol
_XcptFilter
wcstombs
wcscmp
isalnum
_exit
clock
_cexit
mbstowcs
__setusermatherr
strncpy
wcspbrk
__getmainargs
fread
fputs
isprint
wcsncmp
realloc
comdlg32
ChooseColorW
GetSaveFileNameW
PageSetupDlgW
ChooseFontW
FindTextW
CommDlgExtendedError
kernel32
GetCurrentThreadId
SetMailslotInfo
CompareStringW
CreateFileMappingA
SetNamedPipeHandleState
TerminateThread
CreateRemoteThread
ClearCommBreak
SetHandleCount
GetWindowsDirectoryW
CreateSemaphoreA
FindResourceW
IsValidLanguageGroup
LCMapStringA
lstrcmpA
SetCommTimeouts
GlobalLock
GetSystemTimeAdjustment
GetWindowsDirectoryA
CompareStringA
PulseEvent
DisconnectNamedPipe
CloseHandle
WideCharToMultiByte
FindFirstFileA
GetOEMCP
GetStartupInfoW
SuspendThread
LoadLibraryExA
SetEndOfFile
CreateEventA
LocalLock
GetCompressedFileSizeW
GetHandleInformation
GetExitCodeProcess
OpenFileMappingA
lstrcmpiW
GetUserDefaultLCID
GetCommConfig
LockResource
CreateFileMappingW
CreateSemaphoreW
SetLastError
GetModuleHandleW
GetCurrentProcess
CancelIo
GlobalFree
FindClose
DeleteCriticalSection
GetSystemWindowsDirectoryA
lstrlenW
DuplicateHandle
GetLocaleInfoW
Exports
Exports
?RemoveDateTimeA@@YGPA_NPAJEM&U
?KillPointOld@@YGIJ&U
?FormatMediaTypeW@@YGXIGN&U
?HideDataNew@@YGXEMFK&U
?IsValidHeightEx@@YGJPAIKGD&U
?ShowAppNameExA@@YGPAEMEPAM&U
?OnKeyboardEx@@YGFGHG&U
?SendProvider@@YGGHN&U
?EnumListItemW@@YGXM&U
?KillStringW@@YGXPAEFMPAN&U
?InvalidateSemaphoreW@@YGX_N&U
?RemoveTaskNew@@YGGPAFF&U
?GenerateKeyNameNew@@YGPAXJHHG&U
?SetSemaphoreOld@@YGXEPAIDN&U
?IsNotAppNameOld@@YGPAMDM&U
?ModifyThreadOriginal@@YGFPAFIPAFJ&U
?IsValidListExA@@YGPAMPAMFFD&U
?ModifyFile@@YGPAXDE&U
?ShowListItemEx@@YGXPAJPAIEM&U
?GetValueOld@@YGPADKIPAMJ&U
?ValidatePathW@@YGGEKEM&U
?CancelDirectoryExA@@YGPADHG&U
?ModifyCharExA@@YGGD&U
?FormatSemaphoreExW@@YGPAXM&U
?KillSystemExW@@YGPADJM&U
?ShowCommandLineA@@YGKJPAD&U
?CrtVersionExW@@YGPAMKPAJH&U
?LoadTimeOld@@YGPAXMKPAIE&U
?FreeStateExW@@YGNPAID&U
?InvalidateDateTimeOriginal@@YGGPAD&U
?KillProjectNew@@YGMPAGGPAMM&U
?IsNotMonitorEx@@YGDPA_NH&U
Sections
.text Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imp Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.exp Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.byte1 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.code Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.byte0 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 6KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ