c:\Documents and Settings\Windows XP\Desktop\IntunericVladimore.pdb
Static task
static1
Behavioral task
behavioral1
Sample
668528548935a4c50f464a96a39ca9bb_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
668528548935a4c50f464a96a39ca9bb_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
668528548935a4c50f464a96a39ca9bb_JaffaCakes118
-
Size
1.3MB
-
MD5
668528548935a4c50f464a96a39ca9bb
-
SHA1
cadfb7534bbcbb8a5cf88846ea0a335ae4e418b1
-
SHA256
df960295243332a0c90329894e084ce06565f6a36ab6311e6b414d475a1e6911
-
SHA512
12b4b67da62d81b9242113bede7d8c06136a3bb1a2c8bf7e86eecf1bba20f4599486ff312d78c62bded642e2124229b66bd16bdbfddec49d993e17b30dbc89ec
-
SSDEEP
24576:7R3WxgnfT6XxsXEiglZhb1gH/InViYzIiJtdQMgD9XjU:uxBsUi2vk/ezIYbQMgD9Xw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 668528548935a4c50f464a96a39ca9bb_JaffaCakes118
Files
-
668528548935a4c50f464a96a39ca9bb_JaffaCakes118.dll windows:5 windows x86 arch:x86
888edd915d2a6ecceeb383243a778361
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CreateThread
VirtualProtect
GetModuleHandleA
GetModuleFileNameA
DisableThreadLibraryCalls
VirtualAlloc
IsBadWritePtr
ReadProcessMemory
Sleep
IsBadReadPtr
GetCurrentProcess
IsBadHugeReadPtr
ExitProcess
MulDiv
OutputDebugStringA
IsProcessorFeaturePresent
GetSystemInfo
VirtualFree
GetProcAddress
LoadLibraryA
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
user32
GetDesktopWindow
DefWindowProcA
CreateWindowExA
MessageBoxA
MessageBeep
RegisterClassExA
DestroyWindow
GetAsyncKeyState
gdi32
GetCharacterPlacementA
GetTextExtentPoint32A
SetTextColor
DeleteDC
CreateDIBSection
GetGlyphOutlineA
GetDeviceCaps
SetBkColor
DeleteObject
SelectObject
CreateCompatibleDC
SetMapMode
SetTextAlign
GetTextMetricsA
GetObjectW
CreateFontA
CreateFontIndirectW
ExtTextOutW
MoveToEx
GetObjectA
CreateFontIndirectA
GetFontLanguageInfo
GetTextMetricsW
SetBkMode
GetCharacterPlacementW
ExtTextOutA
msvcr90
memset
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
??2@YAPAXI@Z
??3@YAXPAX@Z
system
strstr
malloc
??_U@YAPAXI@Z
memmove
vsprintf
sprintf
free
ceil
_mbsnbcpy
_CIsqrt
_ftol
strncpy
_CIacos
_finite
iswpunct
iswdigit
iswalpha
iswspace
modf
__CxxFrameHandler
floor
d3d9
Direct3DCreate9
advapi32
RegCloseKey
RegOpenKeyA
RegQueryValueExA
Sections
.text Size: 211KB - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ