d:\workspace\directx\proxydll\Release\d3d9.pdb
Static task
static1
Behavioral task
behavioral1
Sample
db4b0ea45a7459e36f71b4e6b3f4c7b5_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
db4b0ea45a7459e36f71b4e6b3f4c7b5_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
db4b0ea45a7459e36f71b4e6b3f4c7b5_JaffaCakes118
-
Size
162KB
-
MD5
db4b0ea45a7459e36f71b4e6b3f4c7b5
-
SHA1
9eb97fdbfdd7c52f646223fa6f809fa378d5b3ab
-
SHA256
95f9a7f7fb51703badd6f83d7bb7b5aec2c0bcec6e23af8f47a60125b3ee00f8
-
SHA512
22ac272907c42c547f58e844ac6379ae7d5c7dd708c12773fe0a03fe878f54fa37da8f6e8f36427d90e2c1df0c5eeb50a565c405c846d35f02be69179515a4d0
-
SSDEEP
3072:V4I1u2CHPmU+dFZcF/ElRJNBYPFDXcVj5d8:VzGFYbYPFDX5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db4b0ea45a7459e36f71b4e6b3f4c7b5_JaffaCakes118
Files
-
db4b0ea45a7459e36f71b4e6b3f4c7b5_JaffaCakes118.dll windows:5 windows x86 arch:x86
cda8296d52a6276c3c63cd5481f5ee5c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
OpenProcess
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
LocalAlloc
GetCurrentThreadId
ReadProcessMemory
WriteProcessMemory
Thread32Next
ResumeThread
SuspendThread
OpenThread
GetCurrentProcessId
Thread32First
CreateToolhelp32Snapshot
VirtualQueryEx
Module32Next
Module32First
GetCurrentProcess
GetLastError
HeapFree
GetProcessHeap
HeapAlloc
WriteFile
CreateFileA
VirtualAlloc
OutputDebugStringA
GetProcAddress
GetProcessVersion
Sleep
GetProcessId
GetCurrentDirectoryA
GetModuleFileNameA
GetSystemDirectoryA
GetVersion
CreateProcessA
MoveFileExA
CopyFileA
DeleteFileA
FreeLibrary
ExitProcess
Beep
LoadLibraryExA
ReadFile
SetEndOfFile
GetLocaleInfoA
GetTickCount
GetModuleHandleA
GetVersionExA
VirtualQuery
VirtualProtect
IsBadWritePtr
lstrcmpiA
LoadLibraryA
RtlUnwind
GetCommandLineA
RaiseException
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
MultiByteToWideChar
LCMapStringW
HeapSize
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
user32
RegisterClassExA
CreateWindowExA
DestroyWindow
DefWindowProcA
CallNextHookEx
GetWindowTextA
MessageBeep
GetActiveWindow
GetMessageExtraInfo
mouse_event
DrawIconEx
GetDC
ReleaseDC
gdi32
CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteObject
DeleteDC
GetDIBits
GetObjectA
Exports
Exports
??0CDllFile@@QAE@PAUHINSTANCE__@@_N@Z
??0CLogBase@@QAE@ABV0@@Z
??0CLogBase@@QAE@XZ
??0CLogEventFilter@@QAE@KW4LOGL_TYPE@@@Z
??0CLogFiltered@@QAE@ABV0@@Z
??0CLogFiltered@@QAE@KW4LOGL_TYPE@@@Z
??0CNTHandle@@QAE@PAX@Z
??0CRoboletLogFile@@QAE@ABU0@@Z
??0CRoboletLogFile@@QAE@XZ
??1CDllFile@@QAE@XZ
??1CLogFiltered@@UAE@XZ
??1CNTHandle@@QAE@XZ
??1CRoboletLogFile@@UAE@XZ
??4CDllFile@@QAEAAU0@ABU0@@Z
??4CLogBase@@QAEAAV0@ABV0@@Z
??4CLogEventFilter@@QAEAAV0@ABV0@@Z
??4CLogFiltered@@QAEAAV0@ABV0@@Z
??4CNTHandle@@QAEAAU0@ABU0@@Z
??4CRoboletLogFile@@QAEAAU0@ABU0@@Z
??BCDllFile@@QBEPAUHINSTANCE__@@XZ
??BCNTHandle@@QBEPAXXZ
??_7CLogBase@@6B@
??_7CLogFiltered@@6B@
??_7CRoboletLogFile@@6B@
??_FCDllFile@@QAEXXZ
??_FCLogEventFilter@@QAEXXZ
??_FCLogFiltered@@QAEXXZ
??_FCNTHandle@@QAEXXZ
?Assert_CheckFail@CLogBase@@QAEXPBD0I@Z
?AttachHandle@CNTHandle@@QAEXPAX@Z
?CloseHandle@CNTHandle@@QAE_NXZ
?CloseHandleLast@CNTHandle@@AAEXXZ
?CloseLogFile@CRoboletLogFile@@QAEXXZ
?Debug_CheckFail@CLogBase@@QAEXPBD0I@Z
?Debug_Error@CLogBase@@QAAHPBDZZ
?Debug_Info@CLogBase@@QAAHPBDZZ
?Debug_Trace@CLogBase@@QAAHPBDZZ
?Debug_Warn@CLogBase@@QAAHPBDZZ
?DetachHandle@CNTHandle@@QAEPAXXZ
?DetachModule@CDllFile@@QAEPAUHINSTANCE__@@XZ
?Event@CLogBase@@QAAHKW4LOGL_TYPE@@PBDZZ
?EventStr@CLogBase@@UAEHKW4LOGL_TYPE@@PBD@Z
?EventStr@CRoboletLogFile@@UAEHKW4LOGL_TYPE@@PBD@Z
?FindDll@CDllFile@@QAE_NPBD@Z
?FreeDll@CDllFile@@QAEXXZ
?FreeDllLast@CDllFile@@IAEXXZ
?GetProcAddress@CDllFile@@QBEP6GHXZPBD@Z
?IsLogged@CLogBase@@UBE_NKW4LOGL_TYPE@@@Z
?IsLogged@CLogEventFilter@@QBE_NKW4LOGL_TYPE@@@Z
?IsLogged@CLogFiltered@@UBE_NKW4LOGL_TYPE@@@Z
?IsLoggedGroupMask@CLogEventFilter@@QBE_NK@Z
?IsLoggedLevel@CLogEventFilter@@QBE_NW4LOGL_TYPE@@@Z
?IsValidDll@CDllFile@@QBE_NXZ
?IsValidHandle@CNTHandle@@QBE_NXZ
?LoadDll@CDllFile@@QAEJPBD@Z
?LoadDllEx@CDllFile@@QAEJPBDI@Z
?OpenLogFile@CRoboletLogFile@@QAEJPBD@Z
?VDebugEvent@CLogBase@@KGHKW4LOGL_TYPE@@PBDPAD@Z
?VEvent@CLogBase@@UAEHKW4LOGL_TYPE@@PBDPAD@Z
?g_Log@@3UCRoboletLogFile@@A
?g_pLog@@3PAVCLogBase@@A
?get_DllHandle@CDllFile@@QBEPAUHINSTANCE__@@XZ
?get_DllInt@CDllFile@@QBEIXZ
?get_LogGroupMask@CLogEventFilter@@QBEKXZ
?get_LogLevel@CLogEventFilter@@QBE?AW4LOGL_TYPE@@XZ
?put_LogGroupMask@CLogEventFilter@@QAEXK@Z
?put_LogLevel@CLogEventFilter@@QAEXW4LOGL_TYPE@@@Z
CheckFullscreen
D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_GetStatus
D3DPERF_QueryRepeatFrame
D3DPERF_SetMarker
D3DPERF_SetOptions
D3DPERF_SetRegion
DebugSetLevel
DebugSetMute
Direct3DCreate9
Direct3DShaderValidatorCreate9
PSGPError
PSGPSampleTexture
Sections
.text Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ