c:\Documents and Settings\Administrator\My Documents\Visual Studio 2005\Projects\wellfirst\release\wellf.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8bc1a6b0b566415e34ef9fb4d394ff00_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8bc1a6b0b566415e34ef9fb4d394ff00_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8bc1a6b0b566415e34ef9fb4d394ff00_JaffaCakes118
-
Size
165KB
-
MD5
8bc1a6b0b566415e34ef9fb4d394ff00
-
SHA1
de1b03cd0f9bfef8436172b31afa8983e7ff7b77
-
SHA256
8755821eae31b997384971821bf4efed167ebb0eef35a411e3521ec661304464
-
SHA512
6763d4517691584942c979c477fca5f14787609628b7cb6757c9f8815b7f4c148f6d6a8a330b936e91fe5934118eaea216a39880caa2f1738e35175323e4e1ee
-
SSDEEP
3072:qudguwZZ2zDXWhrARuvXij5wvJkgqdktkMj:qudEru
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8bc1a6b0b566415e34ef9fb4d394ff00_JaffaCakes118
Files
-
8bc1a6b0b566415e34ef9fb4d394ff00_JaffaCakes118.dll windows:4 windows x86 arch:x86
da657c9152b65e512b587ff85b5c1afe
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SetFileAttributesW
CreateProcessW
LoadLibraryW
ExitProcess
GetCurrentThread
DisableThreadLibraryCalls
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
WideCharToMultiByte
MultiByteToWideChar
GetDriveTypeW
FileTimeToSystemTime
VerSetConditionMask
GetVersionExW
VerifyVersionInfoW
GlobalMemoryStatusEx
lstrcmpiW
FindNextFileW
GetDiskFreeSpaceExW
LocalFree
GetVolumeInformationW
MoveFileExW
HeapSize
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
SetFileTime
SystemTimeToFileTime
OpenProcess
GetWindowsDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetModuleFileNameW
GetSystemDirectoryW
GetComputerNameW
CreateDirectoryW
GetCurrentProcess
CreateThread
WriteProcessMemory
GetCurrentProcessId
CloseHandle
GetExitCodeThread
FindClose
VirtualAllocEx
GetProcAddress
GetLastError
ExitThread
CreateFileW
ReadFile
Sleep
TerminateThread
WriteFile
CreateRemoteThread
GetTickCount
GetModuleHandleW
FindFirstFileW
SystemTimeToTzSpecificLocalTime
GetFileSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
LoadLibraryA
InitializeCriticalSection
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetDateFormatA
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleHandleA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetModuleFileNameA
RtlUnwind
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetTimeFormatA
CreateFileA
user32
GetKeyboardType
GetSystemMetrics
advapi32
BuildExplicitAccessWithNameW
RegEnumValueW
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegQueryInfoKeyW
IsValidAcl
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetUserNameW
OpenProcessToken
ControlService
UnlockServiceDatabase
ChangeServiceConfigW
QueryServiceStatus
StartServiceW
ChangeServiceConfig2W
LockServiceDatabase
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
RegEnumKeyExW
shell32
ShellExecuteW
psapi
EnumProcessModules
EnumProcesses
GetModuleBaseNameW
ws2_32
socket
WSAStartup
inet_addr
WSASocketW
htons
send
closesocket
recv
gethostbyname
connect
Sections
.text Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ