R:\LocalSvnForDailyBuild\guanxi_sg\bin\release\kernel32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5beff906cbb871b36ef14d575597d0d5_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5beff906cbb871b36ef14d575597d0d5_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5beff906cbb871b36ef14d575597d0d5_JaffaCakes118
-
Size
208KB
-
MD5
5beff906cbb871b36ef14d575597d0d5
-
SHA1
e99905accb8f2f239c8420abf4d3a86091ce5508
-
SHA256
c95b5f30505c97dc5184af50cb76863229622762d4ce4ffc900f454a3501fe29
-
SHA512
1905739577b4a60c495690294796c794abafdaab66cc9b34fdcc7303e3c7f18c20dc63bda94be40e73455be9252bbcb82a4e440496a021d10bd27f366c3aa2f3
-
SSDEEP
3072:a5ZI/UxXYGXSxmF2gIeCLcCF7xd2koX6GZ1jrktGcl:4ZuGXSxmYgIrF7xM9Hc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5beff906cbb871b36ef14d575597d0d5_JaffaCakes118
Files
-
5beff906cbb871b36ef14d575597d0d5_JaffaCakes118.dll windows:4 windows x86 arch:x86
47d62a2e746959dc76cf89e17b2174fe
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
psapi
GetModuleInformation
imagehlp
CheckSumMappedFile
user32
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
DestroyMenu
ClientToScreen
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExA
MessageBoxA
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetParent
SendMessageA
GetWindowThreadProcessId
GetSubMenu
GetMenuItemCount
PostQuitMessage
SetWindowTextA
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
GetWindowTextA
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnregisterClassA
DispatchMessageA
GetKeyState
PeekMessageA
ValidateRect
GetMenuState
GetMenuItemID
kernel32
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
GetStdHandle
GetFileType
WriteConsoleW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
ExitProcess
HeapSize
VirtualAlloc
HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree
QueryPerformanceCounter
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
LoadLibraryW
GetStringTypeA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetModuleHandleA
LoadLibraryA
Sleep
GetLastError
SetLastError
InterlockedExchange
MultiByteToWideChar
WideCharToMultiByte
GetVersion
CompareStringA
lstrlenA
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleFileNameA
GetCurrentProcessId
LocalAlloc
LocalFree
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalLock
GlobalReAlloc
GlobalUnlock
GlobalHandle
GlobalAlloc
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
GlobalFree
TlsFree
GetProcAddress
GetModuleFileNameW
InterlockedDecrement
FreeLibrary
FormatMessageA
CloseHandle
ResumeThread
GetCurrentThreadId
WaitForSingleObject
SuspendThread
InterlockedIncrement
GetVersionExA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
lstrcmpA
GetThreadLocale
GlobalFlags
GetLocaleInfoA
GetCPInfo
GetOEMCP
WritePrivateProfileStringA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetCurrentProcess
GetCommandLineA
CreateFileA
TerminateProcess
OpenProcess
Thread32Next
OpenThread
Thread32First
CreateToolhelp32Snapshot
IsBadReadPtr
Module32Next
Module32First
WriteProcessMemory
VirtualAllocEx
ReadProcessMemory
VirtualProtectEx
VirtualProtect
GetTickCount
GetLocalTime
RtlUnwind
RaiseException
GetStringTypeW
shell32
SHFileOperationA
oleaut32
VariantClear
VariantChangeType
VariantInit
gdi32
GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
PtVisible
SetMapMode
RestoreDC
SaveDC
ExtTextOutA
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
Exports
Exports
InitToLoadDll
InstallHook
ResetHook
Sections
.text Size: 136KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 4KB - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ