d:\work\projects\uplevel\release\uplevel.pdb
Static task
static1
Behavioral task
behavioral1
Sample
62fff81c806aa24425a28d01c20bfacb_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
62fff81c806aa24425a28d01c20bfacb_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
62fff81c806aa24425a28d01c20bfacb_JaffaCakes118
-
Size
120KB
-
MD5
62fff81c806aa24425a28d01c20bfacb
-
SHA1
2734900a089586ba827358db1976ebba45ec9ad2
-
SHA256
b92b230dc3306f94f0bd34ae02f0fc6ac298cbfe7026809628b16c426a015420
-
SHA512
5936e77530be54717b34c1496971f72afc5cfa5296ba375deecbac63f12f31677f603c8795b2b7adee0f5f674be35a3b7ce35573a0356f7edfa2c6b1d0cc6597
-
SSDEEP
3072:F1RutJ9+/4v2K+jNYl719zPTl2doegtppTMcu:X0n9+/4v35719l2KeQZx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 62fff81c806aa24425a28d01c20bfacb_JaffaCakes118
Files
-
62fff81c806aa24425a28d01c20bfacb_JaffaCakes118.dll windows:4 windows x86 arch:x86
7a5569d2ebca3de55e2cac8ac0e2ae1c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
Sleep
CloseHandle
CreateFileW
GetFileSize
ReadFile
GetSystemDirectoryA
CreateFileA
WriteFile
MoveFileExA
CreateThread
WaitForSingleObject
CreateEventW
SetEvent
GetCurrentProcessId
LocalFree
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
ResetEvent
OpenProcess
MultiByteToWideChar
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InitializeCriticalSection
LoadLibraryA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
GetSystemTimeAsFileTime
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
RaiseException
RtlUnwind
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
user32
wsprintfW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
oleaut32
VariantClear
SysAllocString
SysFreeString
VariantInit
dnsapi
DnsQuery_A
DnsRecordListFree
wininet
RetrieveUrlCacheEntryFileW
gdiplus
GdipFree
GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromFileICM
GdipSaveImageToFile
GdiplusShutdown
GdiplusStartup
GdipGetImageEncodersSize
GdipGetImageEncoders
ws2_32
WSAStartup
send
recv
closesocket
connect
htons
socket
inet_addr
psapi
GetModuleFileNameExA
Sections
.text Size: 80KB - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ