d:\!!!WORK\awork\soft\soft\Nortel1\QWProtect\QWProtect\Release\WPtect.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f01305e1e0ff21fc2d08cdc87dc13d42_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
f01305e1e0ff21fc2d08cdc87dc13d42_JaffaCakes118
-
Size
126KB
-
MD5
f01305e1e0ff21fc2d08cdc87dc13d42
-
SHA1
33b4731b7b592ef793ab8f9cba2cfb0ec94c931d
-
SHA256
6e3860838d5298d9e4ef15b97bc534d905151ba271a66764ace7b57198326ca6
-
SHA512
18980673e35916b28bde9498a1f252f5fe3e2248476b239a8b65a3f0209101444175afea14c332007641e58c8412f8e7a183aa25c50d2cac55c58b843f6cf450
-
SSDEEP
3072:x6lqL5ar1OqYci1IT1em41LkI5vLGAUC:glqL41VYci1IJemSkKgC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f01305e1e0ff21fc2d08cdc87dc13d42_JaffaCakes118
Files
-
f01305e1e0ff21fc2d08cdc87dc13d42_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
24917ac7d95edab5381ac7b872e8682c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
winhttp
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpenRequest
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
kernel32
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetLastError
GetProcAddress
GetModuleHandleW
lstrcmpiW
TlsFree
TlsAlloc
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
FreeLibrary
MultiByteToWideChar
lstrlenW
LoadResource
FindResourceW
LoadLibraryExW
SetThreadLocale
GetThreadLocale
LockResource
FindResourceExW
WideCharToMultiByte
TlsGetValue
lstrlenA
TlsSetValue
GetCurrentThreadId
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle
FlushFileBuffers
SizeofResource
GetStringTypeW
LCMapStringW
GetStringTypeA
LCMapStringA
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
GetCommandLineA
VirtualFree
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetLastError
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
user32
CharNextW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
advapi32
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
ole32
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
oleaut32
SysAllocStringLen
VarBstrCat
RegisterTypeLi
UnRegisterTypeLi
SysAllocString
LoadTypeLi
LoadRegTypeLi
DispCallFunc
SysStringLen
VariantClear
VariantInit
SysFreeString
VarUI4FromStr
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ