perfdisk.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ff58e85c5978e0a32b8d1e343366d9ec_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ff58e85c5978e0a32b8d1e343366d9ec_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ff58e85c5978e0a32b8d1e343366d9ec_JaffaCakes118
-
Size
82KB
-
MD5
ff58e85c5978e0a32b8d1e343366d9ec
-
SHA1
35972a4cdbca52639ca2fe05b53174378409ca63
-
SHA256
a76f4c8253a5069775072b478e5733d5051864f6995e5b02727795954665ae1d
-
SHA512
34fa8f7d0f29a18526926e309e4582c406494096709a7fbffad36c07f63e246defc2e60e2a6206dfe7fce6239b5db5ad043be0f0994ec22b9fa1d9599609548a
-
SSDEEP
1536:LeOLchj0OSRSQH+xGzzVxVrAks63cjR1iCMSJKIAW:C0ceFHbHrAgst1BJKIA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff58e85c5978e0a32b8d1e343366d9ec_JaffaCakes118
Files
-
ff58e85c5978e0a32b8d1e343366d9ec_JaffaCakes118.dll windows:5 windows x86 arch:x86
82953fe59ce97d574b1cce0266e3c986
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
wcsncmp
memmove
_ftol
_wtol
swprintf
_ltow
wcscpy
wcscmp
wcsstr
towupper
_except_handler3
ntdll
NtQuerySystemInformation
NtClose
RtlNtStatusToDosError
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
NtOpenFile
NtQueryVolumeInformationFile
NtDeviceIoControlFile
RtlInitUnicodeString
NtQueryValueKey
NtOpenKey
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
CreateFileW
GetLastError
DeviceIoControl
SetLastError
QueryPerformanceFrequency
HeapAlloc
lstrlenW
HeapCreate
HeapReAlloc
HeapFree
HeapValidate
HeapDestroy
DisableThreadLibraryCalls
lstrcpyW
lstrcmpW
lstrcmpiW
GetSystemTimeAsFileTime
CloseHandle
SetErrorMode
advapi32
DeregisterEventSource
RegisterEventSourceW
ReportEventA
WmiCloseBlock
WmiQueryAllDataW
WmiOpenBlock
ReportEventW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
Exports
Exports
CloseDiskObject
CollectDiskObjectData
OpenDiskObject
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ