c:\LakeBranch\Childrenfree\Chooseof\Last.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c98532eda83e7b04cdbaad0f586525a8_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
c98532eda83e7b04cdbaad0f586525a8_JaffaCakes118
-
Size
1.0MB
-
MD5
c98532eda83e7b04cdbaad0f586525a8
-
SHA1
def1ecfb83af629015b1e09c8b82250448d4af70
-
SHA256
89a2ccce9769778a17ce0457f0a1ed59232dda52706952f1c07e1fd3953ffb99
-
SHA512
dd707356a610b304b8b9c0ab9a428b6aadd8b9e65ea8e407e40859efc7e643a590fa634edf289e1db2789338703025288afc455ab247e51c48c5fc7f6d2df626
-
SSDEEP
24576:T5umPtwAiyvA/7bGIkFXNr9ypZQf3E/DzLhukd5TkWCfAZgugu:F3Pvo/3G9XNr2A38XhDTkpfAZgugu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c98532eda83e7b04cdbaad0f586525a8_JaffaCakes118
Files
-
c98532eda83e7b04cdbaad0f586525a8_JaffaCakes118.dll windows:6 windows x86 arch:x86
20154f5ee1bb566acd24c9912886cd2d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
advapi32
OpenProcessToken
OpenThreadToken
GetTokenInformation
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupPrivilegeValueA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
DeleteService
OpenSCManagerA
OpenServiceA
QueryServiceStatus
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
SetEntriesInAclA
kernel32
SetStdHandle
SetFilePointerEx
GetProcessHeap
FlushFileBuffers
Sleep
WriteFile
GetConsoleCP
GetConsoleMode
CreateFileW
FindFirstChangeNotificationA
DeleteFileA
HeapSize
FreeEnvironmentStringsW
CreateFileA
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
LoadLibraryExW
FreeLibrary
GetLastError
InterlockedFlushSList
RtlUnwind
RaiseException
WriteConsoleW
InitializeSListHead
RemoveDirectoryA
GetTempPathA
GetStartupInfoA
CreateProcessA
GetTickCount
GetLocalTime
GetEnvironmentStringsW
CreateThread
HeapValidate
HeapFree
HeapReAlloc
HeapAlloc
VirtualProtect
LocalFree
LocalAlloc
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
GetCPInfo
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
SetEvent
ResetEvent
WaitForSingleObjectEx
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
user32
MapWindowPoints
InflateRect
IntersectRect
PostMessageA
InvalidateRect
ValidateRect
ExitWindowsEx
DestroyMenu
EndDeferWindowPos
OpenClipboard
GetSystemMetrics
BeginPaint
gdi32
CreateFontA
SetTextColor
StretchDIBits
SetBkColor
SelectClipRgn
PtVisible
GetStockObject
GetPixel
GetClipBox
CreateRectRgn
CreateBitmap
ole32
CoInitialize
CoUninitialize
CoRegisterClassObject
CoRegisterSurrogate
OleInitialize
OleUninitialize
OleSetContainedObject
ws2_32
socket
WSAAddressToStringA
WSACreateEvent
WSAConnect
WSACloseEvent
WSACleanup
WSAStartup
getsockname
sendto
setsockopt
gethostbyname
gethostname
shlwapi
StrStrA
PathIsURLA
StrCmpNA
winspool.drv
GetJobA
DocumentPropertiesA
GetPrinterDataA
ClosePrinter
AddPrinterConnectionA
OpenPrinterA
comdlg32
CommDlgExtendedError
ChooseFontA
ChooseColorA
GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA
comctl32
ord6
CreateToolbarEx
ImageList_LoadImageA
ImageList_Draw
ImageList_SetOverlayImage
ImageList_Add
ord17
DestroyPropertySheetPage
Sections
.text Size: 729KB - Virtual size: 728KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 277KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 46KB - Virtual size: 415KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ