FilterPipelinePrintProc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a5724bbe36e14bae6841da62ea4785d5_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
a5724bbe36e14bae6841da62ea4785d5_JaffaCakes118
-
Size
229KB
-
MD5
a5724bbe36e14bae6841da62ea4785d5
-
SHA1
6fa0e7b369d2c28d8d7324533342460e6f2392a4
-
SHA256
5e867df6b1f8a268d894bc41178944a1bcc260c4c2cf7a67f43f5dce61f84ff5
-
SHA512
3f83338c8d128255df3cf6d29c32b7687060f74a1c7187186ecdb05d5bc9df3fc7e757dff5c3489ca8623be4df36f382ec0ef0311146c51f36e09b38552507e6
-
SSDEEP
3072:B737Ef2vLkoykPKz4kiDyxh0WUxuUFuHso0iBnSGXmO1PeI6cT1QI/j:28ykPKz4JPgUFFcXWCWv6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a5724bbe36e14bae6841da62ea4785d5_JaffaCakes118
Files
-
a5724bbe36e14bae6841da62ea4785d5_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
3e32f9e1443b80f5f6f260d3405dcf40
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DisableThreadLibraryCalls
CloseHandle
SetLastError
SetEvent
GetLastError
Sleep
WaitForSingleObject
CreateEventW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
LocalFree
FormatMessageW
InterlockedExchange
InitializeCriticalSection
MultiByteToWideChar
TlsSetValue
GetCommandLineA
GetVersionExA
RtlUnwind
RaiseException
HeapAlloc
HeapFree
ExitProcess
GetProcAddress
GetModuleHandleA
TlsFree
TlsGetValue
TlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
HeapReAlloc
HeapSize
VirtualAlloc
IsBadWritePtr
VirtualQuery
LCMapStringA
LCMapStringW
FlushFileBuffers
SetFilePointer
GetCPInfo
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
LoadLibraryA
IsBadReadPtr
IsBadCodePtr
VirtualProtect
GetSystemInfo
SetStdHandle
ReadFile
user32
LoadStringW
oleaut32
SetErrorInfo
SysAllocString
SysFreeString
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
winspool.drv
GetPrinterDriverW
OpenPrinterW
ReadPrinter
WritePrinter
SetJobW
GetJobW
ClosePrinter
StartDocPrinterW
EndDocPrinter
rpcrt4
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrDllUnregisterProxy
NdrOleAllocate
CStdStubBuffer_Connect
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
Exports
Exports
ClosePrintProcessor
ControlPrintProcessor
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EnumPrintProcessorDatatypesW
GetPrintProcessorCapabilities
OpenPrintProcessor
PrintDocumentOnPrintProcessor
Sections
.text Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 142KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE