c:\dnUpdater\npdnu\Release\npdnu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a6a12d7dfaea38aedf83b7db7140cf53_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a6a12d7dfaea38aedf83b7db7140cf53_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a6a12d7dfaea38aedf83b7db7140cf53_JaffaCakes118
-
Size
152KB
-
MD5
a6a12d7dfaea38aedf83b7db7140cf53
-
SHA1
3b4c98637b57162aab5c279c487aed034506b810
-
SHA256
b096314546e18c8a60863a1724d27319daa6cfc6a9b336541c47e9808751045a
-
SHA512
b0b0d664e4fcfa5c56b06cab27a76b54c31cac68344249c32cbe990d50ac0106bdf847ac7502256026bed052af2f682f0f176b3fb820ddf419951b9fd93cb597
-
SSDEEP
3072:sdu0bgSo8x9hkSJUDr8EWsnl5dthgxcdA2VmbC3cfAag:wu00Sx9E8EWsn7hldLMCsfA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a6a12d7dfaea38aedf83b7db7140cf53_JaffaCakes118
Files
-
a6a12d7dfaea38aedf83b7db7140cf53_JaffaCakes118.dll windows:4 windows x86 arch:x86
e8db3094acef5bcc16fbc67c83a79728
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
user32
SetWindowLongA
BeginPaint
EndPaint
DefWindowProcA
kernel32
GetFileType
CloseHandle
GetSystemInfo
VirtualProtect
HeapFree
HeapAlloc
ExitProcess
RtlUnwind
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
InitializeCriticalSection
InterlockedExchange
VirtualQuery
SetFilePointer
LoadLibraryA
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
GetCPInfo
SetStdHandle
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize
FlushFileBuffers
Exports
Exports
NP_GetEntryPoints
NP_Initialize
NP_Shutdown
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ