d:\우재작업\하단바\lolfarm.co.kr\lolfarm\lolfarm\Release\lolfarm.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d0058e6de5786ba91963ec99ecffb5ba_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
d0058e6de5786ba91963ec99ecffb5ba_JaffaCakes118
-
Size
170KB
-
MD5
d0058e6de5786ba91963ec99ecffb5ba
-
SHA1
5425709c8e4776a6b90cc13ccc37758b0ca615e6
-
SHA256
323f5259a6c64d087a0ec91bd7beab66ccfc0f8ae66ada540c72096fde924053
-
SHA512
fd28de621f540e94e0fa72f15ee3accea2f4509bccff5e094bb6baf66fb2022bd22ba5fcb3f5840cf7e2a90191091847d1d8f3494bbbe7c9da21f1cca5af7942
-
SSDEEP
3072:raYAAZCosJFpYtKiHZuBY+TwG+iTO5FrTHzP:raYfsJFYKi5ufTwG1ufP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d0058e6de5786ba91963ec99ecffb5ba_JaffaCakes118
Files
-
d0058e6de5786ba91963ec99ecffb5ba_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
60f731df1d044ac2c2e33bbfa406c0e9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
InterlockedDecrement
SetLastError
lstrcmpW
MulDiv
FreeLibrary
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
SetThreadLocale
GetThreadLocale
WaitForSingleObject
CreateThread
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
ReadFile
SetEndOfFile
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
InterlockedIncrement
SetFilePointer
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
CloseHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
TlsFree
TlsSetValue
TlsAlloc
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentThreadId
GetLocalTime
GetTempPathA
lstrcatA
GetModuleFileNameW
lstrlenA
GetCurrentProcess
FlushInstructionCache
lstrcmpiW
GetModuleHandleW
GetProcAddress
GetLastError
TlsGetValue
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
Sleep
HeapReAlloc
HeapDestroy
HeapCreate
GetCommandLineA
RtlUnwind
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrcpyW
lstrcatW
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
user32
GetClassNameA
IsWindow
GetWindowLongW
DestroyWindow
CharNextW
SetWindowLongW
GetClientRect
MoveWindow
SendMessageW
CallWindowProcW
GetWindow
GetClassInfoExW
LoadCursorW
wsprintfA
DefWindowProcW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterClassExW
RegisterWindowMessageW
BringWindowToTop
UpdateWindow
ShowWindow
CreateWindowExW
UnregisterClassA
CreateAcceleratorTableW
SetFocus
GetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameW
GetDlgItem
GetParent
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
SetWindowPos
GetSysColor
advapi32
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExA
RegOpenKeyA
RegCloseKey
ole32
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleUninitialize
OleInitialize
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
shell32
ShellExecuteA
oleaut32
SysFreeString
OleCreateFontIndirect
SysStringLen
LoadRegTypeLi
DispCallFunc
VariantClear
VariantInit
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysAllocStringLen
shlwapi
StrStrIW
StrChrA
StrStrIA
gdi32
GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
DeleteObject
SelectObject
ws2_32
gethostbyname
recv
send
__WSAFDIsSet
select
connect
ioctlsocket
htons
socket
closesocket
netapi32
Netbios
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ