C:\Users\root\Devel\Projects\Bravostudio\gamevance\bin\gvtl.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b158cf2f6c7ba0e980c293514e64f83c_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
b158cf2f6c7ba0e980c293514e64f83c_JaffaCakes118
-
Size
228KB
-
MD5
b158cf2f6c7ba0e980c293514e64f83c
-
SHA1
4edd249385126128af158fc9138fe892362f0dc8
-
SHA256
c62f14b80342f3a5a6ac1a1b10d75d4832c8437d1d4602220b6cd93e98357e75
-
SHA512
87badfa8b17e8d3d62088395bb2980df83d5192ef7ae76ca0fc8ce18002d03a3b438f53bce64b2fb347a01f41a8db6bade525695e5c80e6f183d4c31e2de6b78
-
SSDEEP
3072:/W+WGd3OzxYlNKhJAfCMEpbX8s1rqxSKXDijq7TBfFvqVYWx5jAc:O+0zClN8JGEpbDaGq7TB9vqKWnA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b158cf2f6c7ba0e980c293514e64f83c_JaffaCakes118
Files
-
b158cf2f6c7ba0e980c293514e64f83c_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
b8b7453e48f11d85bd5eb619f30d1ad7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
shlwapi
StrStrIA
wnsprintfA
StrCmpNIA
StrCmpNA
StrToIntA
wvnsprintfA
StrNCatA
StrStrA
wininet
InternetConnectA
InternetOpenA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetCrackUrlA
InternetGetConnectedState
HttpOpenRequestA
rpcrt4
UuidToStringA
UuidCreate
kernel32
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
lstrlenA
TlsAlloc
GetModuleFileNameA
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
RaiseException
InitializeCriticalSection
SetThreadLocale
GetThreadLocale
lstrlenW
WideCharToMultiByte
GetProcAddress
GetModuleHandleA
GetModuleHandleW
MultiByteToWideChar
GetLastError
FreeLibrary
SizeofResource
LoadResource
FindResourceA
lstrcmpiA
IsDBCSLeadByte
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCurrentThreadId
HeapAlloc
GetProcessHeap
CreateThread
lstrcpynA
GetTickCount
lstrcmpA
TlsSetValue
TlsGetValue
CloseHandle
ReleaseMutex
lstrcpyA
WaitForSingleObject
CreateMutexA
Sleep
GetCurrentProcessId
HeapReAlloc
GetVersionExA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetLocaleInfoA
LoadLibraryExA
GetACP
GetCPInfo
GetStdHandle
WriteFile
HeapDestroy
HeapCreate
VirtualFree
ExitProcess
HeapSize
SetLastError
TlsFree
IsDebuggerPresent
SetUnhandledExceptionFilter
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
GetSystemTimeAsFileTime
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
user32
CharNextA
CharNextW
KillTimer
SetTimer
SendMessageA
FindWindowA
advapi32
RegCloseKey
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegEnumKeyExA
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExA
RegDeleteKeyA
RegQueryInfoKeyA
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CoTaskMemFree
oleaut32
LoadRegTypeLi
VarUI4FromStr
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
RegisterTypeLi
SysFreeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cdata Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ