c:\src\RkVerify - International\Confidence\InstallMonitor\Release\InstallMonitor.pdb
Static task
static1
Behavioral task
behavioral1
Sample
85aac5ebc8f3217c847df716ca944da1_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
85aac5ebc8f3217c847df716ca944da1_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
85aac5ebc8f3217c847df716ca944da1_JaffaCakes118
-
Size
152KB
-
MD5
85aac5ebc8f3217c847df716ca944da1
-
SHA1
1fe516472296875dfbb7349880aa9d19a2538381
-
SHA256
899ef1fe1bde1fbcbe3436735edeba77f7d593f864fcc31e202e5b871d96f86f
-
SHA512
586ee479a5f15d6b0d7a3ab77701fc79560f0ab4b5e87e97aa04de6e50f0cdb62b29c3140b2494f84b70b02e64d184542d5b16bc1ef668127f86c06c862d9ec2
-
SSDEEP
3072:crLKtX1P5YXZYYN5XNdvZlFk70zJjxWRK8yaG7IJeilZajufWpoXCFHJ9iNUy:eK5YJYYN5XNdv1o0958yZGjB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85aac5ebc8f3217c847df716ca944da1_JaffaCakes118
Files
-
85aac5ebc8f3217c847df716ca944da1_JaffaCakes118.dll windows:4 windows x86 arch:x86
1b5fc5b9719e3e9414ef442c46bc9cea
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
kernel32
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
GetLastError
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
lstrlenA
GetCurrentThread
GetModuleFileNameA
GetCurrentProcessId
LoadLibraryA
GetACP
VirtualAlloc
VirtualQuery
InterlockedCompareExchange
GetCurrentThreadId
ResumeThread
VirtualProtect
FlushInstructionCache
GetCurrentProcess
GetThreadContext
SetThreadContext
SuspendThread
FreeLibrary
GetProcAddress
SetLastError
GetModuleHandleA
InterlockedExchange
GetTickCount
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
SetStdHandle
GetLocaleInfoW
IsBadCodePtr
IsBadReadPtr
IsValidCodePage
IsValidLocale
CloseHandle
UnmapViewOfFile
GetComputerNameA
MapViewOfFile
CreateFileMappingA
Process32Next
Process32First
CreateToolhelp32Snapshot
WriteFile
SetFilePointer
CreateFileA
GetLocalTime
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
LocalFree
LocalAlloc
WideCharToMultiByte
ExitProcess
RtlUnwind
HeapFree
HeapAlloc
GetCommandLineA
GetTimeFormatA
GetDateFormatA
LCMapStringA
LCMapStringW
GetCPInfo
HeapReAlloc
QueryPerformanceCounter
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
TerminateProcess
HeapSize
GetSystemInfo
GetOEMCP
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
user32
GetWindowLongA
EnumChildWindows
GetClientRect
GetWindowTextA
GetClassNameA
GetWindowTextW
SendMessageA
CallNextHookEx
GetParent
GetWindowInfo
WindowFromDC
advapi32
InitializeAcl
SetSecurityInfo
RegSetValueExA
RegOpenKeyExA
RegCloseKey
Exports
Exports
KeyboardProc
MouseProc
MsgProc
ShellProc
Sections
.text Size: 100KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ