e:\bbbrrr\DirSize_source\DirSize\ReleaseMinSize\DirSize.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c22acdd5613a79a3d8a3571b3da5ecc6_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
c22acdd5613a79a3d8a3571b3da5ecc6_JaffaCakes118
-
Size
589KB
-
MD5
c22acdd5613a79a3d8a3571b3da5ecc6
-
SHA1
c205752149b3bb85fda800ab1c48a44edf0cbf38
-
SHA256
003af0a8411a8f280a4af0c3ab807b0572a7dbbc782c4f007fcb7889bd683e9e
-
SHA512
6139ee7d60895d0a4d8535aced795780a48ea6c9b388999ea8c1655e3e96e399fb37d3050e5725d53f9bf9c3adc0ebf81eb31849fd84645b6aa69b59e6bd7682
-
SSDEEP
12288:8a35NNMyw08jsI525olVNyM+ptFzo4KsuvBGPvRRDehtQ9tIybxv3:8g5NNhw0UT525oLN6pt1jDRRwtCnxv3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c22acdd5613a79a3d8a3571b3da5ecc6_JaffaCakes118
Files
-
c22acdd5613a79a3d8a3571b3da5ecc6_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
95daca5802fc1a3dddaa23c9a8d1e835
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
InterlockedDecrement
GetModuleHandleA
GetModuleFileNameA
RaiseException
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
InterlockedIncrement
DeleteCriticalSection
EnterCriticalSection
GetProcAddress
GetModuleHandleW
LeaveCriticalSection
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
InitializeCriticalSection
ExitProcess
GetLastError
DisableThreadLibraryCalls
FindFirstFileA
FindNextFileA
FindClose
lstrlenW
WideCharToMultiByte
lstrlenA
IsDBCSLeadByte
MultiByteToWideChar
FlushFileBuffers
CloseHandle
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
RtlUnwind
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
WriteFile
GetStdHandle
FatalAppExitA
VirtualFree
HeapReAlloc
HeapCreate
HeapDestroy
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
LoadLibraryA
GetLocaleInfoW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
InterlockedExchange
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
ReadFile
user32
CharNextA
CharNextW
SendMessageA
advapi32
RegSetValueExA
RegEnumKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegDeleteValueA
CryptAcquireContextW
CryptImportKey
CryptEncrypt
RegQueryInfoKeyA
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 229KB - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 306KB - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ