d:\01_Soce\01_my_Soce\002_MiniPopup\20080801_startline\startline_softnsoft\Release\startline.pdb
Static task
static1
Behavioral task
behavioral1
Sample
74fc42456a558788d3aea2180c022699_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
74fc42456a558788d3aea2180c022699_JaffaCakes118
-
Size
164KB
-
MD5
74fc42456a558788d3aea2180c022699
-
SHA1
c846160e7f1d3c2fe4e1bdfc284968b3f716d0d6
-
SHA256
e6ab67f161b555fae65e85ace3c646ffc1daee66244639815c929e39d9ab86ec
-
SHA512
4e85a632f1d7f56084bcf77f3dc53510f2d0f940e574043cb2aafcfd4b3e1445b671d3680594632d94c0e4b32486f66e658c7e733bd9cf6b0630bbde48b30e17
-
SSDEEP
3072:WDVB5WgzvEJVngRenXNAhl+jjWWGCYHtAdasxLQCBnR:apCngInXNAhl+jji1MBn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 74fc42456a558788d3aea2180c022699_JaffaCakes118
Files
-
74fc42456a558788d3aea2180c022699_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
e1fcb855e898a2f2f9904d0c8ab373ea
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
wininet
InternetOpenUrlA
InternetQueryDataAvailable
InternetCloseHandle
InternetReadFile
InternetOpenA
rpcrt4
IUnknown_AddRef_Proxy
NdrOleFree
NdrOleAllocate
IUnknown_Release_Proxy
NdrStubForwardingFunction
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
IUnknown_QueryInterface_Proxy
kernel32
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
CreateFileA
CloseHandle
FlushFileBuffers
Sleep
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrlenA
lstrcmpiA
GetModuleFileNameA
IsDBCSLeadByte
InterlockedIncrement
InterlockedDecrement
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
SetThreadLocale
GetThreadLocale
DebugBreak
OutputDebugStringA
lstrcpyA
GetProcAddress
LoadLibraryW
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
HeapReAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
VirtualFree
HeapDestroy
HeapCreate
ExitProcess
WriteFile
GetStdHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
WriteConsoleA
HeapSize
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
InterlockedExchange
LoadLibraryA
LCMapStringA
LCMapStringW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
user32
FindWindowA
LoadStringA
UnregisterClassA
CharNextA
advapi32
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
ole32
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
shell32
ShellExecuteA
SHGetSpecialFolderPathA
oleaut32
SysStringLen
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 104KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 4KB - Virtual size: 267B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ