e:\sogouToolbarCVS\p4p\Src\iemon\Release\SohuDAIEHelper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f5408d49c2353e16075ca1e8ecea3ad3_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
f5408d49c2353e16075ca1e8ecea3ad3_JaffaCakes118
-
Size
148KB
-
MD5
f5408d49c2353e16075ca1e8ecea3ad3
-
SHA1
fe5a155085ca59bd215fb25f589af0d13651efcc
-
SHA256
9750bb96a72735ef3e13b8d0dd25f5865ebebf2bd6e883cab4242788eb93523a
-
SHA512
02930759babc630fdd61475e4f56ecaf5322cd9449c2802db292b8f9eaa54aa8db88b24f0a5cf132b5f48124714ead7b6f23c2cb4298d4e790a5acb21748b800
-
SSDEEP
3072:WcqLIqaA19Ffj0bw3z/Oo80kUMbFOeR8MLD6MW0Elc37Yc:7qpbVj5jOBrXFOWe8hf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f5408d49c2353e16075ca1e8ecea3ad3_JaffaCakes118
Files
-
f5408d49c2353e16075ca1e8ecea3ad3_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
1f5ec6f639afdb748c3a433ce30c372d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetACP
GetLocaleInfoA
GetThreadLocale
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
lstrlenA
lstrcmpiA
GetSystemTime
lstrlenW
lstrcpyA
GetModuleHandleA
WaitForSingleObject
GetTickCount
GetLocalTime
InterlockedIncrement
InterlockedDecrement
lstrcpynA
IsDBCSLeadByte
ReleaseMutex
CreateMutexA
SystemTimeToFileTime
CompareFileTime
lstrcatA
InterlockedExchange
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetProcessHeap
SetEndOfFile
ReadFile
GetStringTypeW
GetStringTypeA
GetVersionExA
lstrcmpiW
GetModuleFileNameA
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
RaiseException
CreateEventA
GetLastError
CreateProcessA
FreeLibrary
CloseHandle
LCMapStringW
LCMapStringA
FlushFileBuffers
SetStdHandle
CreateFileA
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
GetCPInfo
GetOEMCP
SetFilePointer
WriteFile
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
FlushInstructionCache
SetUnhandledExceptionFilter
HeapSize
GetCurrentProcess
TerminateProcess
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetCurrentProcessId
QueryPerformanceCounter
GetProcAddress
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
GetCommandLineA
ResumeThread
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapReAlloc
CreateThread
GetCurrentThreadId
GetSystemTimeAsFileTime
ExitProcess
HeapFree
HeapAlloc
RtlUnwind
ExitThread
user32
CharNextA
wsprintfA
PeekMessageA
DispatchMessageA
MsgWaitForMultipleObjects
advapi32
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyA
shell32
SHGetFileInfoA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
StringFromCLSID
CLSIDFromString
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
oleaut32
VariantClear
SysFreeString
SysStringLen
SysAllocString
SysAllocStringByteLen
SysStringByteLen
VarBstrCmp
SysAllocStringLen
VariantCopy
VariantChangeType
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
shlwapi
SHGetValueA
PathFindExtensionA
wininet
InternetOpenUrlA
InternetCloseHandle
InternetOpenA
rpcrt4
UuidToStringA
UuidCreate
ws2_32
recvfrom
send
closesocket
connect
gethostbyname
socket
bind
htons
ntohs
WSAGetLastError
WSAStartup
WSACleanup
htonl
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ