D:\kingsoft\AntiVirus\gateway\V5.0\trunk\Src\C_Client\Src\KWatchFn2\Release\KWatchFn2.pdb
Static task
static1
Behavioral task
behavioral1
Sample
03aa16b7e97255425bd41611c39e4cca_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
03aa16b7e97255425bd41611c39e4cca_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
03aa16b7e97255425bd41611c39e4cca_JaffaCakes118
-
Size
292KB
-
MD5
03aa16b7e97255425bd41611c39e4cca
-
SHA1
2fee85a085066eafdd75444b33d581caa80e0170
-
SHA256
77b2499ad0248a67fd25d3e04335484b4166ae1d7287f5be58eefed2b426f9a5
-
SHA512
fa7ecf308fc2e94f0c7dfb5a3788ed8ed2a2a9306f21f152c5045b6f61a7ce79a0467a13dec3755411e010bbf76041719aea779cf2ee50f6e3f86656283f7214
-
SSDEEP
3072:/hxvl9tTO2V0CYYycPeObBwpbkt3/+vkB+yNHLi563vSficudSOf1QgJ9hVblW55:J1tTZ5mObBwpg12M5NUxdg/flXG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03aa16b7e97255425bd41611c39e4cca_JaffaCakes118
Files
-
03aa16b7e97255425bd41611c39e4cca_JaffaCakes118.dll windows:4 windows x86 arch:x86
03198d4b3a6a73fd998af0f55abeb26b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
WideCharToMultiByte
GetCurrentThreadId
GetModuleFileNameA
DeviceIoControl
OutputDebugStringA
GetLastError
Sleep
GetModuleFileNameW
CopyFileA
GetSystemDirectoryA
GetModuleHandleA
GetVersion
CreateThread
CreateMutexA
InterlockedExchange
MultiByteToWideChar
SizeofResource
LockResource
LoadResource
DeleteFileA
GetVersionExA
lstrlenW
CompareStringA
CompareStringW
lstrcmpiA
lstrcmpiW
lstrlenA
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStringTypeExA
GetStringTypeExW
OpenProcess
SetEnvironmentVariableA
SetEndOfFile
CreateFileW
GetLocaleInfoW
SetStdHandle
WriteConsoleW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
ResetEvent
EnterCriticalSection
LeaveCriticalSection
SetEvent
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
GetPrivateProfileIntA
GetProcAddress
FreeLibrary
CreateFileA
CreateFileMappingA
CloseHandle
MapViewOfFile
GetFileSize
FindResourceA
UnmapViewOfFile
GetConsoleOutputCP
WriteConsoleA
GetThreadLocale
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
IsValidCodePage
GetOEMCP
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
HeapAlloc
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
GetCommandLineA
GetProcessHeap
LCMapStringA
LCMapStringW
GetCPInfo
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
HeapSize
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetACP
user32
LoadStringA
CharLowerA
CharLowerW
CharUpperA
CharUpperW
advapi32
OpenProcessToken
ImpersonateLoggedOnUser
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
StartServiceA
OpenSCManagerA
LockServiceDatabase
OpenServiceA
ChangeServiceConfigA
CreateServiceA
UnlockServiceDatabase
CloseServiceHandle
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RevertToSelf
ole32
CoInitialize
StringFromGUID2
CoUninitialize
CoCreateInstance
oleaut32
SysAllocString
VariantClear
SysFreeString
shlwapi
PathFileExistsA
PathRemoveFileSpecA
PathRemoveFileSpecW
PathAddBackslashA
Exports
Exports
GetClassObject
Unregister
Sections
.text Size: 232KB - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ