c:\cygwin\home\kovid\sw\build\ImageMagick-6.5.6\VisualMagick\bin\IM_MOD_RL_xps_.pdb
Static task
static1
Behavioral task
behavioral1
Sample
82ba162aefe833b8481b38b8daf42e9e_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
82ba162aefe833b8481b38b8daf42e9e_JaffaCakes118.dll
Resource
win10v2004-20240730-en
General
-
Target
82ba162aefe833b8481b38b8daf42e9e_JaffaCakes118
-
Size
111KB
-
MD5
82ba162aefe833b8481b38b8daf42e9e
-
SHA1
b21f44ab5daa39dc5e1c4c07fb6a7f39e1d846e1
-
SHA256
fcffa2c70c7de9dc1db38f617c72ccb50482d40657356a9c438e8a0efb1ad563
-
SHA512
022800f7c52667a9c35326a2f36432ba8b1cd2560eebba453b299e1a6cecca28dc2052089665548888eb0be4430d2a27f2205425ed9b014b1c71bc1d614a8382
-
SSDEEP
3072:4sxzxPn89ee8ZcrdxboZMS41/+98YdqzSDz:3NV89xgcnboZ7SG99dV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 82ba162aefe833b8481b38b8daf42e9e_JaffaCakes118
Files
-
82ba162aefe833b8481b38b8daf42e9e_JaffaCakes118.dll windows:5 windows x86 arch:x86
d1b8b0d1cd26754507fdcee2d17c0808
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
core_rl_magick_
GetFirstImageInList
SyncNextImageInList
ConsolidateCMYKImages
LocaleCompare
DestroyImageInfo
RelinquishUniqueFileResource
ReadImage
SystemCommand
GetDelegateCommands
AcquireUniqueFilename
CopyMagickString
CloneImageInfo
DestroyImage
GetDelegateInfo
PSPageGeometry
ParseAbsoluteGeometry
CloseBlob
LocaleNCompare
ReadBlobByte
ResetMagickMemory
FormatMagickString
ParseGeometry
PSDensityGeometry
DefaultResolution
ThrowMagickException
AcquireUniqueSymbolicLink
DestroyImageList
OpenBlob
AcquireImage
LogMagickEvent
RegisterMagickInfo
ConstantString
SetMagickInfo
UnregisterMagickInfo
msvcr90
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
_errno
strerror
sscanf
kernel32
LoadLibraryA
GetProcAddress
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
Exports
Exports
RegisterXPSImage
UnregisterXPSImage
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 590B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ