c:\Documents and Settings\Admin\My Documents\Visual Studio 2008\Projects\DxtCF\Release\Dx.pdb
Static task
static1
Behavioral task
behavioral1
Sample
647ced6c57034b0d2b3dbfc581b1c871_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
647ced6c57034b0d2b3dbfc581b1c871_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
647ced6c57034b0d2b3dbfc581b1c871_JaffaCakes118
-
Size
1.2MB
-
MD5
647ced6c57034b0d2b3dbfc581b1c871
-
SHA1
df61383d0e2d7b1cb41625a71aed3f6d6c98f7d9
-
SHA256
481a3d4814bd1869ca7a614985112aa96bd2e6ddb817c079e60881870851966f
-
SHA512
af141b8e4478ccf37d80a0ae7ee38700d44b4721cd49b5feff950fc35d8ece73ab12b01ae811b3d68dddf7ce83750b852114463712ddbf49e9ba0af5425233df
-
SSDEEP
12288:AUfloZVVUYFoRS76wmBnKw+dTto2ylZJOV8b2j6Kk7GBwI8HBNh:AxVnos76XxKRdTto5Xb2XBwI8H1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 647ced6c57034b0d2b3dbfc581b1c871_JaffaCakes118
Files
-
647ced6c57034b0d2b3dbfc581b1c871_JaffaCakes118.dll windows:5 windows x86 arch:x86
7efa0c511d94114fd8ce30d2e10767db
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
IsBadReadPtr
GetSystemInfo
GetVolumeInformationA
CreateThread
VirtualProtect
GetModuleHandleA
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
WritePrivateProfileStringA
Sleep
GetPrivateProfileIntA
HeapFree
GetProcessHeap
HeapAlloc
InterlockedCompareExchange
InterlockedExchange
IsProcessorFeaturePresent
MultiByteToWideChar
WideCharToMultiByte
OutputDebugStringA
GetProcAddress
LoadLibraryA
GetVersionExA
GetTimeFormatA
user32
GetCursorPos
GetAsyncKeyState
wsprintfA
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam
CryptHashData
msvcp90
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
wininet
InternetReadFile
InternetOpenA
InternetCloseHandle
InternetOpenUrlA
msvcr90
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
exit
qsort
__CxxFrameHandler
iswspace
iswalpha
iswdigit
iswpunct
floor
_amsg_exit
_strdup
free
ldexp
sscanf
_vsnprintf
isspace
isdigit
_setjmp3
longjmp
_finite
_CIacos
strncpy
_ftol
_CIpow
??2@YAPAXI@Z
_time64
??3@YAXPAX@Z
srand
rand
malloc
clock
vsprintf_s
strstr
sprintf
memset
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
tmpfile
fclose
fwrite
fseek
setlocale
_CIsqrt
_CIsin
_CIcos
_CIatan2
fread
__CxxFrameHandler3
gdi32
GetGlyphOutlineA
CreateDIBSection
GetTextMetricsA
SelectObject
MoveToEx
ExtTextOutA
CreateCompatibleDC
SetMapMode
GetObjectW
GetObjectA
DeleteObject
DeleteDC
ExtTextOutW
SetTextAlign
CreateFontIndirectW
CreateFontIndirectA
GetFontLanguageInfo
GetTextMetricsW
SetBkMode
SetBkColor
SetTextColor
GetCharacterPlacementW
GetCharacterPlacementA
Sections
.text Size: 338KB - Virtual size: 338KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 573KB - Virtual size: 51.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.v-lizer Size: 241KB - Virtual size: 241KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE