d:\workspace\directx\proxydll\Release\d3d9.pdb
Static task
static1
Behavioral task
behavioral1
Sample
da2c29be8b1166be00b77d83f638ca53_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
da2c29be8b1166be00b77d83f638ca53_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
da2c29be8b1166be00b77d83f638ca53_JaffaCakes118
-
Size
162KB
-
MD5
da2c29be8b1166be00b77d83f638ca53
-
SHA1
e9cd21f192d10aa3f725d468e1b42e9fd0df7cce
-
SHA256
c012cc0c339e09adf89a2e7601707e43460055074b221df3d3c56486d341651b
-
SHA512
a1e4e710d05d2505c8f9d51b09826c348cd843688ae077ac468249ba42871888bddaa0e243ab0c95bd8efa75ec2a987eb1d4232e4789c1b767f5b52f73051ee4
-
SSDEEP
3072:Ywi+Jew5vACh8tzP201F4ZUwepAS15CXl:YMoPfkepA1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource da2c29be8b1166be00b77d83f638ca53_JaffaCakes118
Files
-
da2c29be8b1166be00b77d83f638ca53_JaffaCakes118.dll windows:5 windows x86 arch:x86
4006f8e677aac5f60e2626ec8e4152a7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
OpenProcess
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
LocalAlloc
GetCurrentThreadId
ReadProcessMemory
WriteProcessMemory
Thread32Next
ResumeThread
SuspendThread
OpenThread
GetCurrentProcessId
Thread32First
CreateToolhelp32Snapshot
VirtualQueryEx
Module32Next
Module32First
GetCurrentProcess
GetLastError
HeapFree
GetProcessHeap
HeapAlloc
WriteFile
CreateFileA
VirtualAlloc
OutputDebugStringA
GetProcAddress
GetProcessVersion
Sleep
GetProcessId
GetCurrentDirectoryA
GetModuleFileNameA
GetSystemDirectoryA
GetVersion
CreateProcessA
MoveFileExA
CopyFileA
FreeLibrary
ExitProcess
Beep
LoadLibraryExA
ReadFile
SetEndOfFile
GetLocaleInfoA
GetTickCount
GetModuleHandleA
GetVersionExA
VirtualQuery
VirtualProtect
IsBadWritePtr
lstrcmpiA
LoadLibraryA
RtlUnwind
GetCommandLineA
RaiseException
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
MultiByteToWideChar
LCMapStringW
HeapSize
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
user32
RegisterClassExA
CreateWindowExA
DestroyWindow
DefWindowProcA
CallNextHookEx
GetWindowTextA
MessageBeep
GetActiveWindow
GetMessageExtraInfo
mouse_event
DrawIconEx
GetDC
ReleaseDC
gdi32
CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteObject
DeleteDC
GetDIBits
GetObjectA
Exports
Exports
??0CDllFile@@QAE@PAUHINSTANCE__@@_N@Z
??0CLogBase@@QAE@ABV0@@Z
??0CLogBase@@QAE@XZ
??0CLogEventFilter@@QAE@KW4LOGL_TYPE@@@Z
??0CLogFiltered@@QAE@ABV0@@Z
??0CLogFiltered@@QAE@KW4LOGL_TYPE@@@Z
??0CNTHandle@@QAE@PAX@Z
??0CRoboletLogFile@@QAE@ABU0@@Z
??0CRoboletLogFile@@QAE@XZ
??1CDllFile@@QAE@XZ
??1CLogFiltered@@UAE@XZ
??1CNTHandle@@QAE@XZ
??1CRoboletLogFile@@UAE@XZ
??4CDllFile@@QAEAAU0@ABU0@@Z
??4CLogBase@@QAEAAV0@ABV0@@Z
??4CLogEventFilter@@QAEAAV0@ABV0@@Z
??4CLogFiltered@@QAEAAV0@ABV0@@Z
??4CNTHandle@@QAEAAU0@ABU0@@Z
??4CRoboletLogFile@@QAEAAU0@ABU0@@Z
??BCDllFile@@QBEPAUHINSTANCE__@@XZ
??BCNTHandle@@QBEPAXXZ
??_7CLogBase@@6B@
??_7CLogFiltered@@6B@
??_7CRoboletLogFile@@6B@
??_FCDllFile@@QAEXXZ
??_FCLogEventFilter@@QAEXXZ
??_FCLogFiltered@@QAEXXZ
??_FCNTHandle@@QAEXXZ
?Assert_CheckFail@CLogBase@@QAEXPBD0I@Z
?AttachHandle@CNTHandle@@QAEXPAX@Z
?CloseHandle@CNTHandle@@QAE_NXZ
?CloseHandleLast@CNTHandle@@AAEXXZ
?CloseLogFile@CRoboletLogFile@@QAEXXZ
?Debug_CheckFail@CLogBase@@QAEXPBD0I@Z
?Debug_Error@CLogBase@@QAAHPBDZZ
?Debug_Info@CLogBase@@QAAHPBDZZ
?Debug_Trace@CLogBase@@QAAHPBDZZ
?Debug_Warn@CLogBase@@QAAHPBDZZ
?DetachHandle@CNTHandle@@QAEPAXXZ
?DetachModule@CDllFile@@QAEPAUHINSTANCE__@@XZ
?Event@CLogBase@@QAAHKW4LOGL_TYPE@@PBDZZ
?EventStr@CLogBase@@UAEHKW4LOGL_TYPE@@PBD@Z
?EventStr@CRoboletLogFile@@UAEHKW4LOGL_TYPE@@PBD@Z
?FindDll@CDllFile@@QAE_NPBD@Z
?FreeDll@CDllFile@@QAEXXZ
?FreeDllLast@CDllFile@@IAEXXZ
?GetProcAddress@CDllFile@@QBEP6GHXZPBD@Z
?IsLogged@CLogBase@@UBE_NKW4LOGL_TYPE@@@Z
?IsLogged@CLogEventFilter@@QBE_NKW4LOGL_TYPE@@@Z
?IsLogged@CLogFiltered@@UBE_NKW4LOGL_TYPE@@@Z
?IsLoggedGroupMask@CLogEventFilter@@QBE_NK@Z
?IsLoggedLevel@CLogEventFilter@@QBE_NW4LOGL_TYPE@@@Z
?IsValidDll@CDllFile@@QBE_NXZ
?IsValidHandle@CNTHandle@@QBE_NXZ
?LoadDll@CDllFile@@QAEJPBD@Z
?LoadDllEx@CDllFile@@QAEJPBDI@Z
?OpenLogFile@CRoboletLogFile@@QAEJPBD@Z
?VDebugEvent@CLogBase@@KGHKW4LOGL_TYPE@@PBDPAD@Z
?VEvent@CLogBase@@UAEHKW4LOGL_TYPE@@PBDPAD@Z
?g_Log@@3UCRoboletLogFile@@A
?g_pLog@@3PAVCLogBase@@A
?get_DllHandle@CDllFile@@QBEPAUHINSTANCE__@@XZ
?get_DllInt@CDllFile@@QBEIXZ
?get_LogGroupMask@CLogEventFilter@@QBEKXZ
?get_LogLevel@CLogEventFilter@@QBE?AW4LOGL_TYPE@@XZ
?put_LogGroupMask@CLogEventFilter@@QAEXK@Z
?put_LogLevel@CLogEventFilter@@QAEXW4LOGL_TYPE@@@Z
CheckFullscreen
D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_GetStatus
D3DPERF_QueryRepeatFrame
D3DPERF_SetMarker
D3DPERF_SetOptions
D3DPERF_SetRegion
DebugSetLevel
DebugSetMute
Direct3DCreate9
Direct3DShaderValidatorCreate9
PSGPError
PSGPSampleTexture
Sections
.text Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ