C:\Users\misha\Desktop\Флешка\сурсы\lw free\dll\inject.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8c82a5a5338d3a5003a7401d400f9109_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8c82a5a5338d3a5003a7401d400f9109_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8c82a5a5338d3a5003a7401d400f9109_JaffaCakes118
-
Size
1.6MB
-
MD5
8c82a5a5338d3a5003a7401d400f9109
-
SHA1
8d065ca3888e9a209c7b655318ba51e9fcd11db1
-
SHA256
d05cdb7f5400b5d16bf704b870a908d4c4254189933469b8d8267adcf8dfa4a4
-
SHA512
5abd7ddcab891ed8adf0eed35f94ad1fc1f35fb2d8ebc33dcddcb5a1b3367ed4192b451edbff3d773fa355ec1085e836352a028064584ff4b36c8b0fdd2cd9a5
-
SSDEEP
49152:BxTAwCcZIt2xYErDerZ9NG9HNn1v97+Ame2EGBia19UqD8l+k3a08wPH9bSC+l5:rTA/6xYErDerZ9NG9HNn1v97+Ame2EGv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c82a5a5338d3a5003a7401d400f9109_JaffaCakes118
Files
-
8c82a5a5338d3a5003a7401d400f9109_JaffaCakes118.dll windows:6 windows x86 arch:x86
03db44845c4d430f80904bff7108f34c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CreateThread
QueryPerformanceCounter
QueryPerformanceFrequency
GetWindowsDirectoryA
GlobalAlloc
GlobalUnlock
GlobalLock
CreateDirectoryA
FindFirstFileA
FindNextFileA
VirtualAlloc
VirtualFree
VirtualQuery
CloseHandle
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Sleep
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
GetModuleHandleW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetTickCount
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
VirtualProtect
Beep
GetProcAddress
K32GetModuleInformation
GetModuleHandleA
SuspendThread
GetCurrentProcess
InitializeSListHead
user32
GetKeyState
FindWindowA
SetWindowLongA
CloseClipboard
EmptyClipboard
SetClipboardData
GetClipboardData
SetCursor
GetClientRect
wvsprintfA
GetFocus
GetAsyncKeyState
CallWindowProcA
OpenClipboard
GetCursorPos
advapi32
RegOpenKeyExA
RegEnumValueA
RegCloseKey
msvcp140
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?uncaught_exception@std@@YA_NXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xoverflow_error@std@@YAXPBD@Z
?widen@?$ctype@D@std@@QBEDD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Xbad_alloc@std@@YAXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?id@?$ctype@D@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Xtime_get_ticks
_Thrd_sleep
??Bios_base@std@@QBE_NXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
d3dx9_43
D3DXCreateFontA
winmm
PlaySoundA
mciSendStringA
imm32
ImmSetCompositionWindow
ImmGetContext
vcruntime140
memchr
_except_handler4_common
__std_type_info_destroy_list
__std_exception_copy
_purecall
memcmp
__CxxFrameHandler3
_CxxThrowException
memset
memmove
memcpy
strstr
__std_exception_destroy
strchr
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
terminate
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
api-ms-win-crt-string-l1-1-0
strncpy
isprint
strcpy
strncmp
strcmp
strlen
wcslen
_strnicmp
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
api-ms-win-crt-math-l1-1-0
sin
fabs
sqrt
roundf
cos
_except1
asin
atan
atan2
fmaxf
acos
fminf
ceil
_fdtest
fmod
floor
pow
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-stdio-l1-1-0
fputc
fread
fsetpos
_get_stream_buffer_pointers
_fseeki64
__stdio_common_vsnprintf_s
fgetc
fwrite
setvbuf
__stdio_common_vsscanf
__stdio_common_vfprintf
ftell
fseek
fflush
__stdio_common_vsprintf_s
_wfopen
__acrt_iob_func
__stdio_common_vsprintf
fclose
ungetc
fgetpos
api-ms-win-crt-filesystem-l1-1-0
remove
_lock_file
_unlock_file
api-ms-win-crt-convert-l1-1-0
atoi
mbstowcs_s
api-ms-win-crt-time-l1-1-0
_localtime64
clock
_time64
Sections
.text Size: 684KB - Virtual size: 684KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 391KB - Virtual size: 391KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 543KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ