g:\V100r006b002d13sp00c03\utps\solution\win32\NDISPlugin\Release\NDISPlugin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ce0d69818d4b089fcbd5e32490ac8da7_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ce0d69818d4b089fcbd5e32490ac8da7_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ce0d69818d4b089fcbd5e32490ac8da7_JaffaCakes118
-
Size
188KB
-
MD5
ce0d69818d4b089fcbd5e32490ac8da7
-
SHA1
ea823aeff9bd8610068aaec7d2b1e25c2a0aeaab
-
SHA256
12e0064f1e2ca8493586be6aa4f38c96855e08696671e5bec372fa5afe93057a
-
SHA512
21596abe6637eebb096aa7ffba8d12c3f285a24f57c4cd42067f1a945ae6042fd38c295d6710043c492b5d850226084695f2a30b40a1e70340b83065aac54276
-
SSDEEP
3072:vJCMa2hKzwL0JaIwuGZz2mGtpuOpFKdS2qdUY2tbQ:xCQKUQaIwmm3OpFKA1+Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce0d69818d4b089fcbd5e32490ac8da7_JaffaCakes118
Files
-
ce0d69818d4b089fcbd5e32490ac8da7_JaffaCakes118.dll windows:4 windows x86 arch:x86
61e554c61a217081dfbc49f0f3bae61e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
iphlpapi
GetIpAddrTable
GetIfTable
GetAdaptersInfo
ndisapi
NdisSelectDevice
NdisOnPowerbroadcast
NdisDestroyInstance
NdisGetDeviceName
NdisGetDeviceCount
NdisGetConnState
NdisConnectionNotification
NdisDisconnect
NdisCancelConnect
NdisConnect
setupapi
SetupDiOpenDevRegKey
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
mfc71u
ord1473
ord577
ord280
ord578
ord2313
ord304
ord283
ord265
ord266
ord2311
ord293
ord774
ord764
ord762
ord1079
ord1168
ord371
ord1093
ord2263
ord4079
ord1476
ord6133
ord1472
msvcr71
_itoa
??0exception@@QAE@ABV0@@Z
__CxxFrameHandler
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
__security_error_handler
free
_except_handler3
memset
wcsstr
time
__RTDynamicCast
swprintf
wcscmp
wcscpy
printf
_purecall
fseek
ftell
fread
strtol
strstr
sprintf
fopen
fclose
strncmp
strchr
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_CxxThrowException
kernel32
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
DeleteCriticalSection
InitializeCriticalSection
CreateThread
TerminateThread
ReleaseMutex
CreateMutexA
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
ResetEvent
CreateFileW
DeviceIoControl
CloseHandle
CreateEventW
Sleep
GetVersionExW
user32
wsprintfW
advapi32
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
RegQueryInfoKeyW
msvcp71
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
Exports
Exports
CreatePlugin
Sections
.text Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE