c:\cygwin\home\kovid\sw\build\ImageMagick-6.6.6\VisualMagick\bin\IM_MOD_RL_html_.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b266b5eda570b9210f647b78ee331a70_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b266b5eda570b9210f647b78ee331a70_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b266b5eda570b9210f647b78ee331a70_JaffaCakes118
-
Size
110KB
-
MD5
b266b5eda570b9210f647b78ee331a70
-
SHA1
49c3ac25c4c0b4f96b321086af986711db508653
-
SHA256
09759c56d3c4a6415122845ad90960ec0597c7d847e2f6f2908e8d12a45f5b8a
-
SHA512
c3422309aad888a7302acb3e6264f8e8c0c75a8fd72d0c85ee243c82510748775a93eb8a45dfba94d6fb138aba3637e9aa58620f283b579f68d5f6cd15a749af
-
SSDEEP
3072:Mafzhh3Ptq7iS8FoOQcnbSK76TudFCF1P1fua:M09h3xTFHbV7SudIP1fu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b266b5eda570b9210f647b78ee331a70_JaffaCakes118
Files
-
b266b5eda570b9210f647b78ee331a70_JaffaCakes118.dll windows:5 windows x86 arch:x86
6cdfdd2aaef547c9c8cb4852bc5b1a43
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
core_rl_magick_
LocaleNCompare
UnregisterMagickInfo
DestroyImageInfo
WriteImage
NewImageList
GetNextImageInList
WriteBlobByte
ParseAbsoluteGeometry
SetGeometry
FormatMagickString
GetImageProperty
WriteBlobString
CloneImageInfo
GetPathComponent
AppendImageFormat
ConcatenateMagickString
CopyMagickString
LocaleCompare
TransformImageColorspace
CloseBlob
OpenBlob
LogMagickEvent
RegisterMagickInfo
ConstantString
SetMagickInfo
msvcr90
__dllonexit
_lock
_onexit
_except_handler4_common
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
free
_malloc_crt
_encode_pointer
strrchr
_encoded_null
kernel32
LoadLibraryA
GetProcAddress
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
Exports
Exports
RegisterHTMLImage
UnregisterHTMLImage
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 660B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ