winspool.pdb
Static task
static1
Behavioral task
behavioral1
Sample
892b1944bc2500db9bea9637a527b624_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
892b1944bc2500db9bea9637a527b624_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
892b1944bc2500db9bea9637a527b624_JaffaCakes118
-
Size
178KB
-
MD5
892b1944bc2500db9bea9637a527b624
-
SHA1
cd6e5667cd7bc61c1934673ee81a49cae22b4a16
-
SHA256
6ffc97050ff26eb304dac0ec0c86ad43087a2a63ab1e616d3fb8807fb8e18ef6
-
SHA512
97b57e14a4f9702d6fd4c0b123f29bbf0370e45636b8e1b581b27bdf019bc0a2ab9718f609d28b3bf15b687e9b64e41b46f615943cc43109384b06acf6092892
-
SSDEEP
3072:Z92N8kNEd1C4SdplwNGsI0n3wcskhMDgA8FfYuAbWiNFCf1UjYwW3Di:ZMbQ1CRp2p3wcsO4gAWYuqXCtUj/Wz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 892b1944bc2500db9bea9637a527b624_JaffaCakes118
Files
-
892b1944bc2500db9bea9637a527b624_JaffaCakes118.dll windows:5 windows x86 arch:x86
1bb98a0d72f46be3503f55ba5bc72e82
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
wcslen
_except_handler3
wcschr
_vsnwprintf
_wcsnicmp
wcsncmp
wcsncpy
wcsrchr
wcspbrk
wcscmp
??3@YAXPAX@Z
??2@YAPAXI@Z
free
_initterm
_adjust_fdiv
malloc
memmove
_wcsicmp
ntdll
NtQueryInformationProcess
NtFsControlFile
gdi32
CreateDCW
DeleteDC
GetDeviceCaps
kernel32
GetProcAddress
LoadLibraryW
SetLastError
GetModuleFileNameW
GetSystemDirectoryW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
DisableThreadLibraryCalls
LocalFree
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
CloseHandle
DeactivateActCtx
LoadLibraryExW
ActivateActCtx
SetEvent
CreateThread
CreateEventW
ReleaseActCtx
GetFileAttributesW
GetFullPathNameW
InterlockedIncrement
InterlockedDecrement
LocalAlloc
GetFileType
GetLastError
lstrcmpiW
VirtualFree
VirtualAlloc
GetNativeSystemInfo
LoadLibraryA
GetVersionExW
lstrcmpW
GetTickCount
CreateActCtxW
WaitForSingleObject
InterlockedCompareExchange
Sleep
ReleaseMutex
FreeLibrary
GetSystemWindowsDirectoryW
CreateMutexW
ProcessIdToSessionId
OpenEventW
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
FormatMessageW
SearchPathW
GetCurrentDirectoryW
FindClose
FindFirstFileW
ResetEvent
GlobalFree
GlobalAlloc
DnsHostnameToComputerNameW
GetTempFileNameW
GetTempPathW
GetFileSize
SetEndOfFile
DelayLoadFailureHook
SetFilePointer
DeleteFileW
HeapDestroy
HeapAlloc
HeapCreate
HeapFree
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSetInformation
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateDirectoryW
GetSystemInfo
CopyFileW
CreateProcessW
CreateFileW
ReadFile
rpcrt4
RpcMgmtIsServerListening
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcSmDestroyClientContext
RpcBindingFree
I_RpcExceptionFilter
NdrClientCall2
advapi32
RegCloseKey
DeregisterEventSource
ReportEventW
RegisterEventSourceW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
RegOpenCurrentUser
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
RegOpenKeyExW
IsValidSecurityDescriptor
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
GetSecurityDescriptorGroup
SetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
GetSecurityDescriptorLength
MakeSelfRelativeSD
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
user32
GetDesktopWindow
GetWindowLongW
EndDialog
BringWindowToTop
SetWindowLongW
SendDlgItemMessageW
GetDlgItemTextW
MessageBoxW
GetForegroundWindow
SendNotifyMessageW
AllowSetForegroundWindow
IsWindow
GetFocus
GetMessageW
LoadStringW
GetProcessWindowStation
GetUserObjectInformationW
FindWindowW
DialogBoxParamW
PostMessageW
GetGUIThreadInfo
GetParent
WinHelpW
GetWindow
GetLastActivePopup
EnableWindow
SetFocus
SetForegroundWindow
PeekMessageW
DispatchMessageW
TranslateMessage
MsgWaitForMultipleObjects
Exports
Exports
ADVANCEDSETUPDIALOG
AbortPrinter
AddFormA
AddFormW
AddJobA
AddJobW
AddMonitorA
AddMonitorW
AddPortA
AddPortExA
AddPortExW
AddPortW
AddPrintProcessorA
AddPrintProcessorW
AddPrintProvidorA
AddPrintProvidorW
AddPrinterA
AddPrinterConnectionA
AddPrinterConnectionW
AddPrinterDriverA
AddPrinterDriverExA
AddPrinterDriverExW
AddPrinterDriverW
AddPrinterW
AdvancedDocumentPropertiesA
AdvancedDocumentPropertiesW
AdvancedSetupDialog
ClosePrinter
CloseSpoolFileHandle
CommitSpoolData
ConfigurePortA
ConfigurePortW
ConnectToPrinterDlg
ConvertAnsiDevModeToUnicodeDevmode
ConvertUnicodeDevModeToAnsiDevmode
CreatePrinterIC
DEVICECAPABILITIES
DEVICEMODE
DeleteFormA
DeleteFormW
DeleteMonitorA
DeleteMonitorW
DeletePortA
DeletePortW
DeletePrintProcessorA
DeletePrintProcessorW
DeletePrintProvidorA
DeletePrintProvidorW
DeletePrinter
DeletePrinterConnectionA
DeletePrinterConnectionW
DeletePrinterDataA
DeletePrinterDataExA
DeletePrinterDataExW
DeletePrinterDataW
DeletePrinterDriverA
DeletePrinterDriverExA
DeletePrinterDriverExW
DeletePrinterDriverW
DeletePrinterIC
DeletePrinterKeyA
DeletePrinterKeyW
DevQueryPrint
DevQueryPrintEx
DeviceCapabilities
DeviceCapabilitiesA
DeviceCapabilitiesW
DeviceMode
DevicePropertySheets
DocumentEvent
DocumentPropertiesA
DocumentPropertiesW
DocumentPropertySheets
EXTDEVICEMODE
EndDocPrinter
EndPagePrinter
EnumFormsA
EnumFormsW
EnumJobsA
EnumJobsW
EnumMonitorsA
EnumMonitorsW
EnumPortsA
EnumPortsW
EnumPrintProcessorDatatypesA
EnumPrintProcessorDatatypesW
EnumPrintProcessorsA
EnumPrintProcessorsW
EnumPrinterDataA
EnumPrinterDataExA
EnumPrinterDataExW
EnumPrinterDataW
EnumPrinterDriversA
EnumPrinterDriversW
EnumPrinterKeyA
EnumPrinterKeyW
EnumPrintersA
EnumPrintersW
ExtDeviceMode
FindClosePrinterChangeNotification
FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
FlushPrinter
FreePrinterNotifyInfo
GetDefaultPrinterA
GetDefaultPrinterW
GetFormA
GetFormW
GetJobA
GetJobW
GetPrintProcessorDirectoryA
GetPrintProcessorDirectoryW
GetPrinterA
GetPrinterDataA
GetPrinterDataExA
GetPrinterDataExW
GetPrinterDataW
GetPrinterDriverA
GetPrinterDriverDirectoryA
GetPrinterDriverDirectoryW
GetPrinterDriverW
GetPrinterW
GetSpoolFileHandle
IsValidDevmodeA
IsValidDevmodeW
OpenPrinterA
OpenPrinterW
PerfClose
PerfCollect
PerfOpen
PlayGdiScriptOnPrinterIC
PrinterMessageBoxA
PrinterMessageBoxW
PrinterProperties
QueryColorProfile
QueryRemoteFonts
QuerySpoolMode
ReadPrinter
ResetPrinterA
ResetPrinterW
ScheduleJob
SeekPrinter
SetAllocFailCount
SetDefaultPrinterA
SetDefaultPrinterW
SetFormA
SetFormW
SetJobA
SetJobW
SetPortA
SetPortW
SetPrinterA
SetPrinterDataA
SetPrinterDataExA
SetPrinterDataExW
SetPrinterDataW
SetPrinterW
SplDriverUnloadComplete
SpoolerDevQueryPrintW
SpoolerInit
SpoolerPrinterEvent
StartDocDlgA
StartDocDlgW
StartDocPrinterA
StartDocPrinterW
StartPagePrinter
WaitForPrinterChange
WritePrinter
XcvDataW
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE