g:\阿东代码\ByShell_1.20_20110129\Server\bin\SrvPlugin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
eff9b9d37c34219629f6bf2aeb6d5837_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
eff9b9d37c34219629f6bf2aeb6d5837_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
eff9b9d37c34219629f6bf2aeb6d5837_JaffaCakes118
-
Size
216KB
-
MD5
eff9b9d37c34219629f6bf2aeb6d5837
-
SHA1
965c53dd9b1d244582bd3d6a3b349fdc1ac6dd97
-
SHA256
faf745aeeda29c854390556c8e802b7001dbea7d562429dc8f390fc7f4894b48
-
SHA512
f314b89b3e1fd2ed9cedcd75cd083db0f0c7fb658895b17066f10607dbda028e6fe0a66a0acaa89a230514f1ca971cbe1159c3f355cce5f30e17e564f5fdd4b2
-
SSDEEP
3072:mOxN2+XOjuNMO3VliUsc2QA9s36Ykd8t6kVm54JXqhQ5Ygvtd4Xtv:m0SHO3los36vdwVT0hQ5549v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eff9b9d37c34219629f6bf2aeb6d5837_JaffaCakes118
Files
-
eff9b9d37c34219629f6bf2aeb6d5837_JaffaCakes118.dll windows:4 windows x86 arch:x86
9e8fb10a755135d3d557a8ad7f75652f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
ReleaseMutex
ExitProcess
LoadLibraryW
GetProcAddress
GetLastError
CreateDirectoryW
GetFileAttributesW
lstrcpyW
lstrcatW
LocalFree
lstrlenW
LocalReAlloc
LocalAlloc
RemoveDirectoryW
MoveFileW
HeapFree
HeapAlloc
GetProcessHeap
lstrcatA
GetLocalTime
MultiByteToWideChar
GetTickCount
VirtualFree
VirtualAlloc
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
WideCharToMultiByte
CloseHandle
WaitForSingleObject
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
lstrcpyA
FindClose
LockResource
LoadResource
SizeofResource
FindResourceA
LoadLibraryA
lstrcmpiA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
Sleep
LocalSize
lstrlenA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapSize
RtlUnwind
HeapReAlloc
ExitThread
GetCurrentThreadId
CreateThread
RaiseException
GetCommandLineA
GetVersionExA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapDestroy
HeapCreate
user32
LoadCursorA
DestroyCursor
GetCursorInfo
wsprintfW
IsWindow
FindWindowExA
FindWindowA
SendMessageA
wsprintfA
CharNextW
advapi32
RegQueryValueW
shell32
ShellExecuteA
msvfw32
ICClose
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICSeqCompressFrame
ICCompressorFree
ICSeqCompressFrameEnd
winmm
waveInPrepareHeader
waveInStart
waveInGetNumDevs
waveOutWrite
waveInAddBuffer
waveOutGetNumDevs
waveOutClose
waveOutUnprepareHeader
waveOutReset
waveInClose
waveInReset
waveInStop
waveOutPrepareHeader
waveInOpen
waveOutOpen
waveInUnprepareHeader
Exports
Exports
GetDllModuleControlInit
RemoveService
ServiceEntry
ServiceEntry2
Sections
.text Size: 156KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 412B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ