c:\autobuild\root\spyframe\trunk\release\SpyCleaner.pdb
Static task
static1
Behavioral task
behavioral1
Sample
61ba0fb1361924276d245ed02b872ae3_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
61ba0fb1361924276d245ed02b872ae3_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
61ba0fb1361924276d245ed02b872ae3_JaffaCakes118
-
Size
772KB
-
MD5
61ba0fb1361924276d245ed02b872ae3
-
SHA1
8e80c5199870603fe2672160948a29627ebe83e1
-
SHA256
4867c7dfe29d313d03483dd90abb0cb2965bb8b41318cfd485878ac2b8fcb521
-
SHA512
9500837d5917e7165ddcb1b07335dd0ba4cb779f3f56d353f31a9eee84882727b52258dd5dad3b6c6d1cfe7d9feeb8e6c4fd1d05df27adc1cb0273f135fe757e
-
SSDEEP
12288:MWWr3iQZsxaU6RPrd6KSbNhnf8qW0AOwfgaWwVbq:MpiQKIU6tZAbNhC0ANfrWw4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 61ba0fb1361924276d245ed02b872ae3_JaffaCakes118
Files
-
61ba0fb1361924276d245ed02b872ae3_JaffaCakes118.dll windows:4 windows x86 arch:x86
4bd29f48ed0a1771043f05d160ddeac7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
rpcrt4
UuidCreate
msi
ord8
ord73
ord144
ord46
ord103
ord124
ord17
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
kernel32
CreateDirectoryA
CreateFileA
GetBinaryTypeA
GetFileSize
FindFirstFileA
GetFileAttributesA
FindNextFileA
FindClose
GetProcessHeap
ConnectNamedPipe
SleepEx
WriteFile
SetFilePointer
SetLastError
ReadFile
LocalAlloc
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
FlushFileBuffers
DisconnectNamedPipe
VirtualAlloc
VirtualFree
GetModuleFileNameA
GetVersionExA
GetOverlappedResult
GetWindowsDirectoryA
WritePrivateProfileStringA
GetModuleHandleA
GetStdHandle
lstrcpyA
GetLocalTime
TerminateProcess
CreateNamedPipeA
CopyFileA
GetFileTime
FileTimeToSystemTime
GetSystemInfo
RaiseException
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
GetThreadLocale
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
OpenProcess
GetFullPathNameA
SetThreadPriority
ResumeThread
GetCurrentThreadId
SetEvent
SuspendThread
GlobalGetAtomNameA
FileTimeToLocalFileTime
GetModuleFileNameW
InterlockedDecrement
GlobalReAlloc
GlobalHandle
LocalReAlloc
SetErrorMode
InterlockedIncrement
lstrcmpA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalFlags
GetLocaleInfoA
GetCPInfo
GetOEMCP
CreateFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
VirtualProtect
VirtualQuery
GetCommandLineA
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
SetCurrentDirectoryA
SetStdHandle
GetFileType
ExitProcess
RtlUnwind
ExitThread
CreateThread
HeapSize
GetACP
IsValidCodePage
SetHandleCount
GetStartupInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
QueryDosDeviceA
GetCurrentProcessId
SetFileAttributesA
InterlockedExchange
CompareStringW
DeleteCriticalSection
CompareStringA
lstrlenA
GetCurrentProcess
GetVersion
DeleteFileA
Sleep
MoveFileExA
GetDriveTypeA
GetLogicalDrives
LocalFree
WaitForSingleObject
FormatMessageA
TerminateThread
LeaveCriticalSection
Module32Next
Module32First
EnterCriticalSection
Process32Next
Process32First
CreateToolhelp32Snapshot
MoveFileA
CreateIoCompletionPort
InitializeCriticalSection
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
GetEnvironmentVariableA
CloseHandle
CreateEventA
SetEnvironmentVariableA
FreeLibrary
GetProcAddress
LoadLibraryA
GetLastError
MultiByteToWideChar
LockResource
WideCharToMultiByte
ExpandEnvironmentStringsA
SizeofResource
LoadResource
FindResourceA
GetVolumeInformationA
GetCurrentDirectoryA
gdi32
DeleteDC
GetStockObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
SetMapMode
RestoreDC
SaveDC
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
Exports
Exports
MsiInstall
MsiUninstall
PIEDelete
PIEInit
PIENew
Sections
.text Size: 576KB - Virtual size: 573KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 108KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ