snynhcnback.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4cc578ec3db8c09b66e81d1ba3d85c60_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4cc578ec3db8c09b66e81d1ba3d85c60_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4cc578ec3db8c09b66e81d1ba3d85c60_JaffaCakes118
-
Size
72KB
-
MD5
4cc578ec3db8c09b66e81d1ba3d85c60
-
SHA1
e257bef64109d46d7b7e39b2286f8013f96403bc
-
SHA256
e33e3c4cf92cd77e5863fdbb454574280ba4258cdcfbdeb0dd622076a20b961b
-
SHA512
9f56e944b31dc7740a9eb829396d4446f5cd24624e475a4549343402edbae17ad90953018774a9da4438929bc2bd69b56b77c9a9faf354fadbfce62684503223
-
SSDEEP
1536:mrtXJZ5N9yIFqYNFW4l5gzzAp2LGe/+enXsjAWtNjx:8tb3M4qYNFWC5WA1enXs8SNF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4cc578ec3db8c09b66e81d1ba3d85c60_JaffaCakes118
Files
-
4cc578ec3db8c09b66e81d1ba3d85c60_JaffaCakes118.dll windows:4 windows x86 arch:x86
b088e68ff02f60963ed13fdd1842697b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FreeEnvironmentStringsA
LeaveCriticalSection
SetLastError
GetCurrentThreadId
ConnectNamedPipe
WaitForMultipleObjects
HeapAlloc
LCMapStringA
IsBadReadPtr
GetVersionExA
InitializeCriticalSection
ResetEvent
lstrcatW
HeapFree
GetSystemInfo
DeleteCriticalSection
WaitForSingleObject
DuplicateHandle
GetStdHandle
EnterCriticalSection
GetLocaleInfoA
LoadLibraryA
GetLastError
GetCPInfo
IsBadCodePtr
CreateTimerQueueTimer
GetOEMCP
WriteFile
GetModuleHandleA
SetUnhandledExceptionFilter
QueryPerformanceCounter
UnhandledExceptionFilter
GetStartupInfoA
GetEnvironmentStringsW
CreateNamedPipeA
GetACP
OpenProcess
SetEvent
ReleaseMutex
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchangeAdd
WideCharToMultiByte
GetTickCount
UnmapViewOfFile
RtlUnwind
FreeEnvironmentStringsW
InterlockedExchange
MultiByteToWideChar
HeapDestroy
GetEnvironmentStrings
GetFileType
InterlockedCompareExchange
IsBadWritePtr
lstrcpyW
InterlockedDecrement
CreateMutexW
GetModuleFileNameA
LCMapStringW
GetBinaryTypeA
DisconnectNamedPipe
TerminateProcess
CreateEventA
DeleteTimerQueueTimer
user32
wsprintfW
LoadIconA
DrawIcon
CreateIconFromResource
advapi32
InitializeSecurityDescriptor
GetUserNameA
SetSecurityDescriptorDacl
msvcrt
_stricmp
_wtoi
_wcsnset
fflush
vwprintf
_strnicmp
memset
towupper
wcstol
wcsstr
_ltow
wcscmp
printf
wcstod
strtok
wprintf
calloc
memcpy
wcscpy
wcslen
realloc
fprintf
wcscat
fgetws
wcsncmp
malloc
memmove
wcschr
isdigit
swprintf
scanf
free
wcstok
exit
Exports
Exports
wtxeyql
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 762B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ