Y:\Mars\Release\Header2.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d55ad544600b0e28cfe9916d462e133b_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d55ad544600b0e28cfe9916d462e133b_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d55ad544600b0e28cfe9916d462e133b_JaffaCakes118
-
Size
106KB
-
MD5
d55ad544600b0e28cfe9916d462e133b
-
SHA1
7c866ce8ce29f2f91871132e2f8ee89d4da23548
-
SHA256
b63f521bca4f3cc6f8767e93572ae718879c2cf961a98f85d502e925fa76b848
-
SHA512
6c527fdc7c51192d1b967a8f8f5453c8200ff94276d507dc5e0427bdc5094ff948080a69a72608530c9b3df8322b406b3aaa5d77c5dc5b58771d5fe1e5eeffd8
-
SSDEEP
1536:zWqLFKtSZJJg2pSFKSZaifVWG0cYgv7kk9FnzwlVLsOhmL9y1:vLSSZJJg2AFhlx0jlZsomL9y1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d55ad544600b0e28cfe9916d462e133b_JaffaCakes118
Files
-
d55ad544600b0e28cfe9916d462e133b_JaffaCakes118.dll windows:5 windows x86 arch:x86
83555b4873cebcd50ebe80b3f3c918ef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
SetFilePointer
WriteFile
FlushFileBuffers
GetFileSize
lstrcatA
GetTickCount
LoadLibraryA
GetProcAddress
FreeLibrary
VirtualAlloc
lstrcmpiA
ReadFile
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateDirectoryA
SetFileAttributesA
FindFirstFileA
GetLastError
FindNextFileA
FindClose
GetFileAttributesA
CompareStringW
CreateFileW
CreateFileA
lstrcpyA
DeleteFileA
GetTempPathA
GetModuleFileNameA
GetPrivateProfileStringA
GetSystemDirectoryA
Sleep
GetPrivateProfileIntA
GetCurrentProcess
SetErrorMode
lstrcpynA
lstrlenA
ExitProcess
VirtualFree
WideCharToMultiByte
GetStringTypeW
LCMapStringW
MultiByteToWideChar
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
HeapReAlloc
SetEnvironmentVariableA
RtlUnwind
IsValidCodePage
GetOEMCP
HeapAlloc
HeapFree
ExitThread
GetCurrentThreadId
CreateThread
GetSystemTimeAsFileTime
DecodePointer
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
EncodePointer
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetTimeZoneInformation
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
LoadLibraryW
HeapSize
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
user32
wsprintfA
advapi32
CryptGetHashParam
CryptVerifySignatureA
CryptImportKey
CryptReleaseContext
CryptDestroyHash
CryptDestroyKey
CryptDecrypt
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextA
RegCloseKey
RegOpenKeyExW
RegEnumValueA
shell32
SHCreateDirectoryExA
ws2_32
socket
connect
WSAStartup
closesocket
gethostbyname
recv
send
htons
shlwapi
PathRemoveFileSpecA
StrStrA
StrStrIA
Exports
Exports
OnInject
ServiceMain
start
Sections
.text Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ