K:\NMC\Current\WinZip\WZShlExt\w32prod\wzshlext.pdb
Static task
static1
Behavioral task
behavioral1
Sample
731a738ca2a89ffcf27d46f5e763ff45_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
731a738ca2a89ffcf27d46f5e763ff45_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
731a738ca2a89ffcf27d46f5e763ff45_JaffaCakes118
-
Size
292KB
-
MD5
731a738ca2a89ffcf27d46f5e763ff45
-
SHA1
287d79f38b91435bc661373ddac58922fbf37119
-
SHA256
846b98d07ba019be758d14e3041dacf377419ee8dddd98edcddec97a78e33314
-
SHA512
f964b30d662743491e9b2d02e59d66ee20d58e83abcfe50e3316cbb0cc1b65e2fa6b8a55eda7a76daa1b1334efcb96319c76ed7e1318c3ba90bab9bd3223b446
-
SSDEEP
6144:Gaj5gds2DngeeNMPaZRupn+aZGVXpEqI2JX6gAy/AwL:Gajids2WEc8B+XLEqIeX6gAy/7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 731a738ca2a89ffcf27d46f5e763ff45_JaffaCakes118
Files
-
731a738ca2a89ffcf27d46f5e763ff45_JaffaCakes118.dll windows:4 windows x86 arch:x86
6a6b1666edeb628f2e3650c866e29d05
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetLocalTime
FormatMessageA
RaiseException
GetLastError
SetLastError
WideCharToMultiByte
MultiByteToWideChar
InterlockedDecrement
DisableThreadLibraryCalls
InterlockedIncrement
IsDBCSLeadByte
lstrcmpA
GetDriveTypeA
GetFileSize
SetFilePointer
ReadFile
CloseHandle
CreateFileA
GetFileAttributesA
GetShortPathNameA
WinExec
FindClose
FindFirstFileA
GetEnvironmentVariableA
GetWindowsDirectoryA
GetTempFileNameA
WriteFile
FreeLibrary
GetProcAddress
LoadLibraryA
GetTempPathA
ExitProcess
RtlUnwind
CreateDirectoryA
GetCurrentThreadId
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
HeapFree
InterlockedExchange
VirtualQuery
HeapAlloc
GetModuleHandleA
GetModuleFileNameA
GetCurrentProcess
CompareStringA
GetCPInfo
CompareStringW
GetOEMCP
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
InitializeCriticalSection
GetStringTypeA
GetStringTypeW
VirtualProtect
GetSystemInfo
LCMapStringA
LCMapStringW
SetEndOfFile
HeapSize
GlobalMemoryStatus
GetLocaleInfoA
GetACP
GetVersionExA
lstrcmpiA
TerminateProcess
lstrlenA
user32
OemToCharA
IsCharAlphaNumericA
InsertMenuItemA
LoadStringA
LoadBitmapA
CharNextA
MessageBoxA
CreatePopupMenu
GetSystemMetrics
shell32
SHGetFileInfoA
DragQueryFileA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
ole32
ReleaseStgMedium
advapi32
RegCloseKey
RegOpenKeyExA
RegOpenKeyA
RegQueryValueExA
gdi32
DeleteObject
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE