e:\060227_100621_build_cli\Client_Build_SnowPlow_7_50_103\source\nsclientax\Release\nsclientax.pdb
Static task
static1
Behavioral task
behavioral1
Sample
def3788358bae7675ec7477881668d42_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
def3788358bae7675ec7477881668d42_JaffaCakes118.dll
Resource
win10v2004-20240910-en
General
-
Target
def3788358bae7675ec7477881668d42_JaffaCakes118
-
Size
38KB
-
MD5
def3788358bae7675ec7477881668d42
-
SHA1
302041a0f0f9bc32b82e05f9d648a006c59b905b
-
SHA256
1969b4d4b7db9f6892ceeda64a840b8e108b830c8fb81a677b3e801220345275
-
SHA512
7ee0fff8d47bf25fefdc7a76bff240980106aa9213a172c2dde34c32d1523c4aadcb05d675c4d0b9f15ba81c9b5940c66c415b05ee2ecd1ef16aec1753d576de
-
SSDEEP
768:DgmC7glDxPtRfPdze2LOJViT2vwYA7clfUSJlF:DgmC7glDxPbPdze2LGVLYY9lfNl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource def3788358bae7675ec7477881668d42_JaffaCakes118
Files
-
def3788358bae7675ec7477881668d42_JaffaCakes118.dll windows:4 windows x86 arch:x86
6ecad9177211fbb40beb08f94c3dc643
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetSystemInfo
VirtualProtect
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
HeapFree
GetCurrentThreadId
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
VirtualQuery
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
HeapSize
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
GetOEMCP
GetCPInfo
LoadLibraryA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
QueryPerformanceCounter
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
SysAllocStringLen
SysFreeString
Exports
Exports
NP_GetEntryPoints
NP_Initialize
NP_Shutdown
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ