c:\src.5.7\drivers\ActivControl2\x86\ActivFocusHook.pdb
Static task
static1
Behavioral task
behavioral1
Sample
aa15b451e2328c6c292f4b83d7ecc09d_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
aa15b451e2328c6c292f4b83d7ecc09d_JaffaCakes118
-
Size
155KB
-
MD5
aa15b451e2328c6c292f4b83d7ecc09d
-
SHA1
e45cd68f0d12b090f73570e101b24f9eec4300c7
-
SHA256
bd1845ee9e9cf1bc967d63ca8869ea613fbfbe969036db331fb090ce832857ff
-
SHA512
5d1c6d2f720b16a990c8a02015f00f1bb932aa5af217e4d23dc63e240f919a455b5ffb229c0542d12d23d3b2c44690857b5c7d8933903f624f169bec80a998f6
-
SSDEEP
3072:SX+25FGwsiac5lLM3eKvNyrjBLCcYvWte/Vq+f7bG/dw/dwAiq:SO8FG1YsNyxLLe/k+/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa15b451e2328c6c292f4b83d7ecc09d_JaffaCakes118
Files
-
aa15b451e2328c6c292f4b83d7ecc09d_JaffaCakes118.dll windows:5 windows x86 arch:x86
209da3c0d9925b330b4de9c52f1de6c4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
GetEnvironmentStrings
OpenEventW
SetEvent
CloseHandle
CreateEventW
LoadLibraryW
GetProcAddress
OpenProcess
FreeLibrary
FlushFileBuffers
CreateFileA
GetLocaleInfoA
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
RaiseException
GetLastError
HeapFree
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
HeapSize
VirtualAlloc
HeapReAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
GetWindowThreadProcessId
wsprintfW
UnhookWindowsHookEx
SetWindowsHookExW
PostMessageW
IsWindow
CallNextHookEx
RegisterWindowMessageW
Exports
Exports
ActivFocusGetHwndProcessNameA
ActivFocusGetHwndProcessNameExA
ActivFocusGetHwndProcessNameExW
ActivFocusGetHwndProcessNameW
ActivFocusRegisterNotificationEvent
ActivFocusRegisterNotificationWindow
ActivFocusStartHook
ActivFocusStopHook
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SHARED Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ