C:\ rezolver\rezolverhook.20 — к30\build\Win32\Release\shonax.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f9b315ba1e3023f57e7e280bbd9a7c8f_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f9b315ba1e3023f57e7e280bbd9a7c8f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f9b315ba1e3023f57e7e280bbd9a7c8f_JaffaCakes118
-
Size
9.0MB
-
MD5
f9b315ba1e3023f57e7e280bbd9a7c8f
-
SHA1
5d971b517413802decfd079dd4a9a9183dcb524c
-
SHA256
2cff038509c3b25ddc2c1717266d1bbc07ba596a7c695a45eb7ececb7b8d5e6b
-
SHA512
e67e829bc01dcc93cf87bfc0232368a9e5fe603ef78352c8c7e974c6a8502385506fba18caefd29d92ac550ae14725e5332eebfce3196930068c9d52e7d773a2
-
SSDEEP
196608:3DhTBrGxV9EXqtMIjW7fwBWa4tRVEMSFxbf8srwzCoPMSSPFO2Kx:brGDuNeEXEjrYSP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9b315ba1e3023f57e7e280bbd9a7c8f_JaffaCakes118
Files
-
f9b315ba1e3023f57e7e280bbd9a7c8f_JaffaCakes118.dll windows:6 windows x86 arch:x86
0802dcfb5f869276eaaf4c40eb96dc46
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FindFirstFileA
FindNextFileA
GetWindowsDirectoryA
MultiByteToWideChar
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentProcess
CreateThread
SetPriorityClass
GetPriorityClass
DisableThreadLibraryCalls
GetModuleHandleA
GetProcAddress
WideCharToMultiByte
VirtualAlloc
VirtualFree
VirtualQuery
CloseHandle
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
GetModuleHandleW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
K32GetModuleInformation
EnterCriticalSection
GetTickCount
LoadLibraryA
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
SetLastError
AreFileApisANSI
FindNextFileW
FindFirstFileExW
CreateDirectoryW
FormatMessageA
LoadLibraryExA
GetModuleFileNameA
FreeLibrary
GetLastError
InitializeSListHead
FindClose
VirtualProtect
CreateDirectoryA
user32
GetClipboardData
OpenClipboard
CallWindowProcA
SetClipboardData
CloseClipboard
GetAsyncKeyState
EmptyClipboard
IsChild
GetKeyState
GetCapture
SetCapture
ReleaseCapture
GetForegroundWindow
GetClientRect
SetCursorPos
SetCursor
GetCursorPos
ClientToScreen
ScreenToClient
LoadCursorA
FindWindowA
shell32
SHGetFolderPathA
SHGetKnownFolderPath
ShellExecuteA
ole32
CoTaskMemFree
msvcp140
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Winerror_message@std@@YAKKPADK@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xbad_function_call@std@@YAXXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?is@?$ctype@D@std@@QBE_NFD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?rdstate@ios_base@std@@QBEHXZ
?fail@ios_base@std@@QBE_NXZ
?setf@ios_base@std@@QAEHH@Z
?setf@ios_base@std@@QAEHHH@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBE_JXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPBD@Z
?bad@ios_base@std@@QBE_NXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
_Xtime_get_ticks
_Thrd_sleep
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??Bios_base@std@@QBE_NXZ
?good@ios_base@std@@QBE_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPBD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?width@ios_base@std@@QAE_J_J@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
d3dx9_43
D3DXCreateTextureFromFileA
D3DXCreateTextureFromFileInMemory
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
xinput1_3
ord4
ord2
vcruntime140
_except_handler4_common
__std_type_info_destroy_list
strrchr
_setjmp3
memset
__CxxFrameHandler3
_CxxThrowException
memcpy
__std_terminate
_purecall
strchr
__std_exception_destroy
__std_exception_copy
memcmp
memchr
strstr
memmove
longjmp
api-ms-win-crt-runtime-l1-1-0
exit
_initterm_e
_initterm
_errno
_cexit
system
abort
strerror
_crt_atexit
_execute_onexit_table
_register_onexit_function
terminate
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0
free
malloc
realloc
_callnewh
api-ms-win-crt-math-l1-1-0
_libm_sse2_log_precise
_libm_sse2_exp_precise
_libm_sse2_cos_precise
_libm_sse2_asin_precise
_libm_sse2_acos_precise
_CIfmod
frexp
tan
_libm_sse2_sin_precise
pow
_libm_sse2_sqrt_precise
sqrt
fmaxf
llround
_libm_sse2_tan_precise
ldexp
atan2
cos
_libm_sse2_pow_precise
_except1
_dtest
fabs
ceil
sin
exp
fmod
_dsign
_libm_sse2_log10_precise
atan
_fdtest
floor
_CIatan2
api-ms-win-crt-string-l1-1-0
iswalpha
isblank
strcoll
strpbrk
iscntrl
isgraph
ispunct
islower
strncpy
toupper
isupper
strncmp
isprint
isalpha
wcslen
strcmp
strlen
tolower
strcpy_s
towlower
isspace
strspn
isalnum
isdigit
isxdigit
api-ms-win-crt-stdio-l1-1-0
fclose
__stdio_common_vfprintf
ftell
fseek
_wfopen
__acrt_iob_func
__stdio_common_vsscanf
ungetc
setvbuf
fwrite
_fseeki64
fgets
fsetpos
fread
fputc
fgetpos
fgetc
fflush
__stdio_common_vsprintf
fopen
feof
ferror
tmpnam
freopen
__stdio_common_vsprintf_s
clearerr
_ftelli64
tmpfile
_popen
_pclose
_get_stream_buffer_pointers
getc
api-ms-win-crt-utility-l1-1-0
srand
rand
abs
qsort
labs
api-ms-win-crt-time-l1-1-0
_difftime64
_time64
strftime
_localtime64
_gmtime64
_mktime64
clock
api-ms-win-crt-convert-l1-1-0
strtoul
atoi
strtod
strtoll
strtoull
atof
strtol
api-ms-win-crt-filesystem-l1-1-0
rename
remove
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
setlocale
localeconv
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 502KB - Virtual size: 502KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5.2MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 130KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ