S:\wkujeJptRjw\frVnOhBiqEqR\lsJXvoyyit\DvYLRaHAbtytp\cYQrvugpKa.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a49d09983ae356f5fb4b44f1dff67287_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a49d09983ae356f5fb4b44f1dff67287_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a49d09983ae356f5fb4b44f1dff67287_JaffaCakes118
-
Size
142KB
-
MD5
a49d09983ae356f5fb4b44f1dff67287
-
SHA1
c0eec765835c00c4f4277b23db3fff86bdc3b7df
-
SHA256
3ec69fa27ca6688bd85dd9961b907a53c9fd326e36e3138d6767a42666e2f911
-
SHA512
904b0a7266fe99f0b888b9773822c7eafd70f940d9f9c4b1c627b59bfba25e682f888003d1258372c961506845b625a88cf403f0e172a503ccfb4d43fe1a529f
-
SSDEEP
3072:pLm2leEM9qXLLuel9roubeSq5vwMaMvZ1N:pLHlP/gSq5oMaMR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a49d09983ae356f5fb4b44f1dff67287_JaffaCakes118
Files
-
a49d09983ae356f5fb4b44f1dff67287_JaffaCakes118.dll windows:5 windows x86 arch:x86
3b2f62522b0c307109a72f0193b0598a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
gdi32
TranslateCharsetInfo
SetMapMode
Ellipse
CreateBitmap
GetTextExtentPoint32A
RoundRect
CreateFontIndirectW
RemoveFontResourceW
CreateFontW
GetCurrentObject
OffsetViewportOrgEx
StartPage
GetTextAlign
user32
GetWindowRect
GetMenu
GetForegroundWindow
GetWindowTextA
SetMenu
CloseDesktop
ValidateRect
GetClassLongW
CheckMenuRadioItem
DeferWindowPos
GrayStringW
LoadCursorW
UnloadKeyboardLayout
ShowCursor
GetSysColorBrush
SetRect
DestroyMenu
GetClientRect
TrackPopupMenu
CreateIconIndirect
GetSubMenu
CascadeWindows
RegisterWindowMessageW
GetScrollPos
SetMenuItemInfoW
GetWindowTextW
ClipCursor
LoadBitmapW
DefFrameProcA
shlwapi
StrToInt64ExA
PathSearchAndQualifyA
StrStrA
ChrCmpIA
UrlGetPartW
ntdll
memset
kernel32
GetBinaryTypeA
GetFileInformationByHandle
FindResourceExA
ConvertDefaultLocale
GetComputerNameA
VerSetConditionMask
CompareStringW
GetVersionExA
GetTickCount
lstrlenW
SetCurrentDirectoryW
lstrcatA
GetOverlappedResult
LocalLock
lstrcpynA
SetEndOfFile
FoldStringW
GetThreadLocale
lstrcmpiW
Sleep
msvcrt
exit
comdlg32
PrintDlgW
PageSetupDlgW
GetSaveFileNameW
Exports
Exports
?uF_DPynnuhFDONBa@@YGMPAM@Z
?GYKYQ__Dbk@@YGKFPAD@Z
?LDXIXYWHVDnOD@@YGPAHJ@Z
?ooreg_oD_GioczYArocXX@@YG_NPAJPAD@Z
?pvxgvtkauWZPOCUCS___b_@@YGEPAI@Z
?c_mqyjITSY_F@@YGHK@Z
?PLKrjs_eg@@YGPAXD@Z
?_qmmmni@@YGXPAD@Z
?tz_oZNVA_oaydib@@YGPAHH@Z
RunAs
?___jamyxVIAWN_XQL@@YGGEJ@Z
?cEtTJA_WmK_LNXRH__X_@@YGPAIPAJG@Z
?znx_thEC@@YGPAGMI@Z
?ugngEQMOqqg_k_T_@@YGIPAFPAH@Z
?_OWW_P_Y_Fc_uh_f@@YGMD@Z
?wPWI_WR_inx_IUqi_qv@@YGIPAD@Z
?oj_vi_Q_L_US_CGdX@@YGEPAFF@Z
?__P_ZMMEEH@@YGPAFE@Z
?PCELUYN__B_@@YGMPAJD@Z
?nrE_Kvzakn_YFJ_KYRR_EJ@@YGNPAFF@Z
?zon___mR@@YGPAIPAG@Z
?NDI_jpdb_ZR@@YGXE@Z
?bn_zgXPBB_Br@@YGPANJF@Z
?qepnv_o__@@YGPAXK@Z
?At_s_cvCU_HGffw@@YGGHM@Z
?_mxnq_q_bsAIL@@YGGK@Z
?_b_uFVIptlzdnmOHu@@YGKFM@Z
?AX_KVTQY_CG@@YGEPAF@Z
?xwdfcRCBJWIKycBJBI@@YGKPAEPAH@Z
?_pevyuxnMk_pEM@@YGPAKPAHI@Z
?__PX_JYMZVN_USU@@YGIPAN_N@Z
?kixaprl_da_o_zzujquHV_@@YGHI@Z
?WRIC_Pu_c@@YGKPAM_N@Z
SensNotifyNetconEvent
?RCH_CFH_KMU_MFLZRb_rk@@YGPAKHF@Z
?QUYnnq_zs@@YGFJPAM@Z
?fh_egplnk___oWLTQ@@YGGPAGPAK@Z
?MJNXPFXRUvgdf__cr_hq@@YGPAXD@Z
SensNotifyRasEvent
SensNotifyWinlogonEvent
?_NUQ__RBSWKJM_T_pd@@YGEEK@Z
?pwqeMOOGPkg_n_lNBF@@YGD_N@Z
?oxk_bxgGMEUNP_F@@YGXIF@Z
?PCCPCWZW___D_KN_I_@@YGDJ@Z
?nrdrfD_@@YGNM@Z
?_evqeWzxsr_uojf_y@@YGPAMPAD@Z
?_d_i_mgdDVE__VZf@@YGDJPAG@Z
?EIXEAT_OOf@@YGPAGJ@Z
ServiceMain
?CA__RWk@@YGXM@Z
?w_jTHQPKCAEUHWFKSHDF_@@YGPAMJF@Z
?K_GMAxvdYDIRGs@@YGPAGJPAK@Z
?tx___qyzZdX@@YGDIPAM@Z
StartAs
?UBZFI__SXZ@@YGXEE@Z
?DXF_WXD_@@YGGI_N@Z
?U_Y_RLa_zVH_JdCV@@YGPAIM@Z
?__oGJ__itkfanfd@@YGMFE@Z
?jwnecoFT_eU@@YGJEPAJ@Z
?SGXpd_w@@YGPANJPA_N@Z
?N_PO__JLng_fb@@YGNKPAH@Z
�xB
Sections
.text Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.icode Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 30KB - Virtual size: 229KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ldata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 531B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ