e:\逗游\IESpy\Hookie\Release\Hookie.pdb
Static task
static1
Behavioral task
behavioral1
Sample
951d2c4fd4bee4aafadeb4c43d79a7e7_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
951d2c4fd4bee4aafadeb4c43d79a7e7_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
951d2c4fd4bee4aafadeb4c43d79a7e7_JaffaCakes118
-
Size
120KB
-
MD5
951d2c4fd4bee4aafadeb4c43d79a7e7
-
SHA1
7dcba0c5dcb048c01c642d03180f58118e27be2a
-
SHA256
83aac8c05c471d4feede4f002ac0f6e153062c78ac0eddef55ed3e8fc32a7d36
-
SHA512
f738fc3f84b52eb4f6b9eb730ff6e50a84134599f68d708f73ecc03a39e78e5e3562b77990d50b21dfad5ed31be7d42cc30d67ba9f06f88fe7e19cb469ba99eb
-
SSDEEP
1536:LpJ9KXIw4SrsIFiJMo9zQmSA3eOnyv3ZPVFGxXtmAHGUtAC85:LpKXIw4fIwSmv8JbGHmqhtAC85
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 951d2c4fd4bee4aafadeb4c43d79a7e7_JaffaCakes118
Files
-
951d2c4fd4bee4aafadeb4c43d79a7e7_JaffaCakes118.dll windows:4 windows x86 arch:x86
1557d12b7b845ad1578cbe7910a2c712
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
TerminateProcess
OutputDebugStringA
CreateFileA
OpenFileMappingA
CreateFileMappingA
CloseHandle
MapViewOfFile
UnmapViewOfFile
GetCurrentProcessId
GetSystemDirectoryA
CreateToolhelp32Snapshot
Process32First
GetProcAddress
Process32Next
GetFileAttributesA
GetModuleHandleA
GetModuleFileNameA
CreateThread
WriteProcessMemory
TerminateThread
VirtualProtect
OutputDebugStringW
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
InitializeCriticalSection
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
ReadProcessMemory
LoadLibraryA
GetCurrentProcess
GetVersionExA
ExitProcess
Sleep
GetLastError
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
HeapAlloc
MultiByteToWideChar
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetProcessHeap
RaiseException
RtlUnwind
GetCPInfo
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
HeapSize
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
WriteFile
GetStdHandle
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
user32
GetWindowTextW
SetClassLongA
GetClassLongA
SetWindowLongA
SetWindowsHookExA
EnumWindows
EnumChildWindows
GetWindowThreadProcessId
GetClassNameA
CallNextHookEx
FindWindowExA
FindWindowA
SendMessageW
CallWindowProcW
CallWindowProcA
SendMessageTimeoutW
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
Exports
Exports
LockMainPage
SetMyHwnd
StartHook
Sections
.text Size: 76KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
MyShared Size: 4KB - Virtual size: 528B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ