i:\DEV\Clones\BannerModifier_dummy\_release\BM.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5ec95a71f6b48ea02b35fea71809bb09_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5ec95a71f6b48ea02b35fea71809bb09_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5ec95a71f6b48ea02b35fea71809bb09_JaffaCakes118
-
Size
105KB
-
MD5
5ec95a71f6b48ea02b35fea71809bb09
-
SHA1
823be54a69ff9a05182f0d218c338780e7c75216
-
SHA256
3d023db084d6be41be6f8f4386810f1e7c275ad1eaa58b872783a5d16895059f
-
SHA512
ef99be93e8fdd4123056a3008454ac49374cf1ca2a3e958b66c1b883263fbf82ee9a57aa77859eb8c876da89d8ba06be111cb9352462ee131fae614044fdc6b4
-
SSDEEP
1536:kfGc2ayJdRziRyW4i/CaPSKNqZzflIO6nToIfXcpr241iUlxgMO6yIy:bJZu7/Cx1vWTBfXa2LUXgMO6Ry
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ec95a71f6b48ea02b35fea71809bb09_JaffaCakes118
Files
-
5ec95a71f6b48ea02b35fea71809bb09_JaffaCakes118.dll windows:4 windows x86 arch:x86
084380df9651733c8264aac1e4a1f20e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_initterm
_XcptFilter
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
rand
srand
_amsg_exit
_itoa
mbstowcs
malloc
isdigit
strtol
calloc
free
memcmp
_time64
atoi
isspace
atol
atof
strtoul
wcstombs
_strnicmp
strncmp
strstr
strncpy
strlen
_purecall
_adjust_fdiv
_wcsicmp
memcpy
??_V@YAXPAX@Z
??_U@YAPAXI@Z
memmove
memset
wcslen
??2@YAPAXI@Z
??3@YAXPAX@Z
wcschr
_vsnwprintf
_wcslwr
_strlwr
_except_handler3
shlwapi
StrStrA
StrCatW
StrCpyW
StrStrIW
wvnsprintfW
StrStrIA
kernel32
FreeLibrary
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
RtlUnwind
OpenFileMappingW
LoadLibraryA
GetCurrentThreadId
SetLastError
FlushInstructionCache
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
TerminateThread
ResetEvent
CreateEventW
LocalFree
GetVersionExW
EnterCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
InitializeCriticalSection
lstrlenA
LeaveCriticalSection
GetCurrentThread
SetThreadPriority
WaitForMultipleObjects
VirtualFree
SetFilePointer
ReadFile
lstrcpynW
InterlockedIncrement
DisableThreadLibraryCalls
lstrcpyW
ReleaseMutex
lstrcmpiW
GetModuleFileNameW
GetLastError
FreeLibraryAndExitThread
CreateProcessW
GetCurrentProcessId
CreateMutexW
CreateThread
InterlockedDecrement
ExitProcess
lstrcatW
CreateRemoteThread
WaitForSingleObject
GetCurrentProcess
WriteProcessMemory
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
VirtualAllocEx
HeapAlloc
HeapFree
GetProcessHeap
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleW
GetVolumeInformationW
lstrlenW
LoadLibraryW
CloseHandle
GetWindowsDirectoryW
CreateFileW
OpenEventW
SetEvent
Sleep
lstrcmpiA
OpenProcess
VirtualFreeEx
RaiseException
LocalAlloc
user32
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
PostMessageW
wsprintfW
advapi32
FreeSid
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
RegSetKeySecurity
InitializeSecurityDescriptor
SetEntriesInAclW
SetSecurityDescriptorDacl
RegCreateKeyW
AllocateAndInitializeSid
GetUserNameA
CreateProcessAsUserW
RegCreateKeyExW
DuplicateTokenEx
CheckTokenMembership
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegDeleteValueW
RegFlushKey
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
Exports
Exports
a
s
Sections
.text Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ