d:\Dev08\Kernel\Engine\release\Fix.pdb
Static task
static1
Behavioral task
behavioral1
Sample
95ce8a5cc38b849c7fc29e7d5bae97d5_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
95ce8a5cc38b849c7fc29e7d5bae97d5_JaffaCakes118
-
Size
388KB
-
MD5
95ce8a5cc38b849c7fc29e7d5bae97d5
-
SHA1
4eff5db1ec7b275ddccf22600b1e399165b0748a
-
SHA256
791aab2fa004b5131ad9ab98e639a8dccc6cf08ed34dc17501368f6dafb96c48
-
SHA512
0d9296c34bc786931102f098b16a3d9ba95d030c77204d4ed5b4a60aff426a88e7eca3ddd40705f09e5cc05bd5671f7b1dcb2c16299e6908d48d18cefb50440c
-
SSDEEP
6144:jXVPSdHTpSjRIIZ0109judAP9PVkAbFkyhj55gbVdTQ3r9:jlu1SjRIIUAPFubGlypUB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 95ce8a5cc38b849c7fc29e7d5bae97d5_JaffaCakes118
Files
-
95ce8a5cc38b849c7fc29e7d5bae97d5_JaffaCakes118.dll windows:4 windows x86 arch:x86
f2632afa08ade65db746adb928d88cd1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
shfolder
SHGetFolderPathW
kernel32
FindClose
FreeLibrary
InterlockedExchange
LocalFree
FormatMessageA
GetLocalTime
GetSystemTime
SetFilePointer
DeleteFileA
GetFileSize
CreateFileA
SetLastError
GetModuleFileNameA
WaitForSingleObject
MapViewOfFileEx
UnmapViewOfFile
lstrlenA
GetCurrentProcess
CompareStringA
GetModuleHandleA
GetSystemDirectoryA
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetWindowsDirectoryA
GetVersion
WriteFile
ReadFile
IsBadWritePtr
IsBadReadPtr
OpenProcess
TerminateProcess
CloseHandle
LoadResource
LockResource
SizeofResource
RaiseException
GetLastError
WriteConsoleA
CreateDirectoryA
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
SetEndOfFile
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RtlUnwind
ExitThread
ResumeThread
CreateThread
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCurrentThreadId
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
IsDebuggerPresent
HeapCreate
VirtualFree
GetOEMCP
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
Sleep
LCMapStringA
FreeEnvironmentStringsA
GetEnvironmentStrings
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
advapi32
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
UnlockServiceDatabase
LockServiceDatabase
OpenServiceW
EnumServicesStatusW
QueryServiceLockStatusW
OpenSCManagerW
EnumDependentServicesW
QueryServiceObjectSecurity
SetServiceObjectSecurity
DeleteService
CreateServiceW
QueryServiceConfigW
QueryServiceStatus
StartServiceW
ControlService
ChangeServiceConfigW
CloseServiceHandle
RegCloseKey
RegRestoreKeyW
ole32
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
shlwapi
PathFileExistsA
user32
UnregisterClassA
Exports
Exports
CreateFixer
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 188KB - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE