i:\DEV\Clones\BannerModifier_dummy\_release\BM.pdb
Static task
static1
Behavioral task
behavioral1
Sample
65cee675048a62f3b0272068340b7b4b_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
65cee675048a62f3b0272068340b7b4b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
65cee675048a62f3b0272068340b7b4b_JaffaCakes118
-
Size
105KB
-
MD5
65cee675048a62f3b0272068340b7b4b
-
SHA1
5211d2e7cbce9536fcaf9f822a3c4d5bb2dafed2
-
SHA256
16b9efd47eeb87592bd2b4716d26582aa8b10b1a939d1902d715491cb2fc5f1b
-
SHA512
2052feb6b01a0d0564fad21838cbdf9bed79e8d77ee78968ba82cade3079b4f2e9ada884be7397bd6d99921f6534fd12404dd6a89ab4d1e7148caa43d69c15d6
-
SSDEEP
1536:kfGc2ayJdRziRyW4i/CaPSKNqZzflIO6nToIfXcpr241iUlxgMO6yIj:bJZu7/Cx1vWTBfXa2LUXgMO6Rj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65cee675048a62f3b0272068340b7b4b_JaffaCakes118
Files
-
65cee675048a62f3b0272068340b7b4b_JaffaCakes118.dll windows:4 windows x86 arch:x86
084380df9651733c8264aac1e4a1f20e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_initterm
_XcptFilter
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
rand
srand
_amsg_exit
_itoa
mbstowcs
malloc
isdigit
strtol
calloc
free
memcmp
_time64
atoi
isspace
atol
atof
strtoul
wcstombs
_strnicmp
strncmp
strstr
strncpy
strlen
_purecall
_adjust_fdiv
_wcsicmp
memcpy
??_V@YAXPAX@Z
??_U@YAPAXI@Z
memmove
memset
wcslen
??2@YAPAXI@Z
??3@YAXPAX@Z
wcschr
_vsnwprintf
_wcslwr
_strlwr
_except_handler3
shlwapi
StrStrA
StrCatW
StrCpyW
StrStrIW
wvnsprintfW
StrStrIA
kernel32
FreeLibrary
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
RtlUnwind
OpenFileMappingW
LoadLibraryA
GetCurrentThreadId
SetLastError
FlushInstructionCache
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
TerminateThread
ResetEvent
CreateEventW
LocalFree
GetVersionExW
EnterCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
InitializeCriticalSection
lstrlenA
LeaveCriticalSection
GetCurrentThread
SetThreadPriority
WaitForMultipleObjects
VirtualFree
SetFilePointer
ReadFile
lstrcpynW
InterlockedIncrement
DisableThreadLibraryCalls
lstrcpyW
ReleaseMutex
lstrcmpiW
GetModuleFileNameW
GetLastError
FreeLibraryAndExitThread
CreateProcessW
GetCurrentProcessId
CreateMutexW
CreateThread
InterlockedDecrement
ExitProcess
lstrcatW
CreateRemoteThread
WaitForSingleObject
GetCurrentProcess
WriteProcessMemory
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
VirtualAllocEx
HeapAlloc
HeapFree
GetProcessHeap
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleW
GetVolumeInformationW
lstrlenW
LoadLibraryW
CloseHandle
GetWindowsDirectoryW
CreateFileW
OpenEventW
SetEvent
Sleep
lstrcmpiA
OpenProcess
VirtualFreeEx
RaiseException
LocalAlloc
user32
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
PostMessageW
wsprintfW
advapi32
FreeSid
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
RegSetKeySecurity
InitializeSecurityDescriptor
SetEntriesInAclW
SetSecurityDescriptorDacl
RegCreateKeyW
AllocateAndInitializeSid
GetUserNameA
CreateProcessAsUserW
RegCreateKeyExW
DuplicateTokenEx
CheckTokenMembership
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegDeleteValueW
RegFlushKey
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
Exports
Exports
a
s
Sections
.text Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ