e:\MyProject\taobaoxie\taobaoxie\Release\taobaoxie.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fe44865c6a996a13e19be59e4147b3dd_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
fe44865c6a996a13e19be59e4147b3dd_JaffaCakes118
-
Size
192KB
-
MD5
fe44865c6a996a13e19be59e4147b3dd
-
SHA1
c21ced4d9286019884fbb186ef473c24dc9d9b79
-
SHA256
384677d1a6b8e6d3968eb5380fb3e6914f94520c2c2d66856918b54a9f4ac3aa
-
SHA512
3fa555119ba4a68c1777fba1d943b699f8cf8a9bff427961327c7a3d557bf810e4896b391be32d804ba101d90a01c3f9716d94e00eea6c5a3ef5f9e576d02c73
-
SSDEEP
3072:5OrWenSEs8pWPwUUAA4oNelsreld5uqGWW49Gn37hgF8/aGjtAnsv4Ts:ArvpWPfUAAv/+wJz4G37e4jtA2L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fe44865c6a996a13e19be59e4147b3dd_JaffaCakes118
Files
-
fe44865c6a996a13e19be59e4147b3dd_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
f53e77b52a265d2c2ce1be7acc24d1ca
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
WideCharToMultiByte
lstrlenW
GetLastError
lstrlenA
lstrcmpiA
InterlockedDecrement
lstrcpynA
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
IsDBCSLeadByte
GetModuleFileNameA
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
GetWindowsDirectoryA
GetProcAddress
LoadLibraryA
CloseHandle
WaitForSingleObject
MultiByteToWideChar
GetLocalTime
CreateMutexA
GetPrivateProfileSectionA
SetEndOfFile
UnmapViewOfFile
FlushFileBuffers
SetFilePointer
GetBinaryTypeA
GetFullPathNameA
QueryDosDeviceA
OpenFileMappingA
GetShortPathNameA
GetDriveTypeA
GetTempFileNameA
FlushViewOfFile
FindFirstFileA
lstrcpyA
lstrcatA
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
CreateProcessA
InterlockedExchange
SetStdHandle
ReadFile
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
ExitProcess
RtlUnwind
HeapFree
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
TerminateProcess
GetCurrentProcess
HeapSize
LCMapStringA
LCMapStringW
GetOEMCP
GetCPInfo
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
user32
CharNextA
IsCharAlphaNumericA
advapi32
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
ole32
CoCreateInstance
CoTaskMemRealloc
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
oleaut32
SysAllocString
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
SysStringLen
LoadTypeLi
LoadRegTypeLi
SysFreeString
shlwapi
PathFindExtensionA
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ