d:\01_Soce\01_my_Soce\002_MiniPopup\20080605_popguide\popguide\Release\popguide.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a151083e969ec1c43869a510550b716c_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
a151083e969ec1c43869a510550b716c_JaffaCakes118
-
Size
152KB
-
MD5
a151083e969ec1c43869a510550b716c
-
SHA1
c9f439e08436b9540b21ddcaadff4c72ca21e77c
-
SHA256
4656aa62dd465e5d2012e2412649603dda664dafa314b01650989b4a35c60f09
-
SHA512
bfda3786b612d5b05137f2e7c2bc901130d16a3e69dcb206339abce70f424426995cf693c4297cc493aa699e5bf575aa7df5a5e25849d117f579534fc8a712f0
-
SSDEEP
3072:KrO2r9ft21aDsKgR5UCtfPREvTwVIQQN3DQe1:LGrBDs/jlhRg8mNzh1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a151083e969ec1c43869a510550b716c_JaffaCakes118
Files
-
a151083e969ec1c43869a510550b716c_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
7e2097a22045fd58d49fc3bd8af25f6d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
wininet
InternetOpenUrlA
InternetQueryDataAvailable
InternetCloseHandle
InternetReadFile
InternetOpenA
rpcrt4
IUnknown_AddRef_Proxy
NdrOleFree
NdrOleAllocate
IUnknown_Release_Proxy
NdrStubForwardingFunction
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
IUnknown_QueryInterface_Proxy
kernel32
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle
FlushFileBuffers
HeapSize
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrlenA
lstrcmpiA
GetModuleFileNameA
IsDBCSLeadByte
InterlockedIncrement
InterlockedDecrement
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
SetThreadLocale
GetThreadLocale
DebugBreak
OutputDebugStringA
lstrcpyA
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetProcAddress
GetSystemInfo
VirtualQuery
RtlUnwind
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
VirtualFree
HeapDestroy
HeapCreate
ExitProcess
WriteFile
GetStdHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
WriteConsoleA
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange
LoadLibraryA
LCMapStringA
LCMapStringW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
user32
FindWindowA
LoadStringA
UnregisterClassA
CharNextA
advapi32
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExA
RegDeleteKeyA
ole32
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
shell32
ShellExecuteA
SHGetSpecialFolderPathA
oleaut32
SysStringLen
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 4KB - Virtual size: 267B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ