c:\build\source\filesystem\http\rel32\httpfsys.pdb
Static task
static1
Behavioral task
behavioral1
Sample
642f2a024826ebc49a4a64676dcbe082_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
642f2a024826ebc49a4a64676dcbe082_JaffaCakes118
-
Size
291KB
-
MD5
642f2a024826ebc49a4a64676dcbe082
-
SHA1
0ecbeac724cd40ec7774f949b90f51f495ab6607
-
SHA256
9670c37f8de6df54b632656690f340271e00514e52d6a2ca9f008ef2e446cdc0
-
SHA512
5ceb8e2749aa398b365ba5e8ae1041a54894a87b72972098b222e643ca8db399f2728b7b1ce56c2b045fcaa2e2a992c14ff9f9d32b902e0adf76c51a4b9565ca
-
SSDEEP
6144:fGGlc+DuMz5ZgPlCcJVzUYkBwRd86rOyvpb23OwdHYORf6+81:fGGlc+qM1ZgPlCcJVzxkZ6EOILRf6+81
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 642f2a024826ebc49a4a64676dcbe082_JaffaCakes118
Files
-
642f2a024826ebc49a4a64676dcbe082_JaffaCakes118.dll windows:5 windows x86 arch:x86
8752e0cc03358613447ff6367c93ef62
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleFileNameA
GetModuleHandleA
GetDiskFreeSpaceA
FreeLibrary
GetProcAddress
LoadLibraryA
WaitForSingleObject
CreateMutexA
ReleaseMutex
CloseHandle
DeleteFileA
FindClose
GetWindowsDirectoryA
CreateDirectoryA
FindFirstFileA
GetDriveTypeA
RemoveDirectoryA
SetFileAttributesA
GetFileAttributesA
FindNextFileA
MoveFileA
GetSystemInfo
UnmapViewOfFile
GetLastError
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
GetTempFileNameA
GetTempPathA
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
LocalFileTimeToFileTime
GetCurrentProcessId
GetCurrentThreadId
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
user32
CharNextA
GetSystemMetrics
CharPrevA
msvcr90
atol
memcpy
??_U@YAPAXI@Z
strncpy
strncmp
sscanf
free
strtol
sprintf
memmove
fclose
fwrite
fopen
remove
_localtime32
calloc
fflush
malloc
strspn
fread
_time32
asctime
isspace
strchr
iscntrl
getenv
strtok
_errno
_fstat32
_chsize
_findfirst32
_findnext32
_findclose
strncat
_vsnprintf
tolower
isupper
memset
strtoul
isdigit
isalnum
islower
isxdigit
isalpha
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
atoi
??_V@YAXPAX@Z
_purecall
_stat32
_strnicmp
_stricmp
strstr
strrchr
??2@YAPAXI@Z
??3@YAXPAX@Z
_lseek
_tell
_read
_write
fprintf
_unlink
_getcwd
_chdir
_close
_creat
_open
_sopen
Exports
Exports
CanUnload
RMACreateInstance
RMAShutdown
Sections
.text Size: 139KB - Virtual size: 139KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 108KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE