mswsock.pdb
Static task
static1
Behavioral task
behavioral1
Sample
07d586d5ba87677a9bad40f90afd7f77_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
07d586d5ba87677a9bad40f90afd7f77_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
07d586d5ba87677a9bad40f90afd7f77_JaffaCakes118
-
Size
310KB
-
MD5
07d586d5ba87677a9bad40f90afd7f77
-
SHA1
c15300340ae491f4b48596453a1b8a3a2a393722
-
SHA256
74f4c1237dd6b4b42d2ea5a18b713f391d37957ab2ffa414a70e04c08652a039
-
SHA512
b197648e80549f94d0e2e0c5eb07307bff7de0dab25d3f2f962d606408afc1cb99885ee90efceaf78282708f42e81247031584efab3d3ddc86bcb0703705646c
-
SSDEEP
6144:bIvKNFNLNDOiVAw9Hge052AMnJvz4WgM0jgbTr1od6:vNnJuMSWWgbT46
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 07d586d5ba87677a9bad40f90afd7f77_JaffaCakes118
Files
-
07d586d5ba87677a9bad40f90afd7f77_JaffaCakes118.dll windows:5 windows x86 arch:x86
5f2e63ac6ed529c9a722f003b415644e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
wcslen
wcsncpy
wcscat
_except_handler3
strtoul
malloc
exit
_adjust_fdiv
_initterm
free
strncmp
wcsncmp
wcstol
_wcsnicmp
swprintf
_snwprintf
strcpy
strlen
wcschr
atoi
_wcsicmp
_stricmp
memmove
wcscmp
getc
fopen
fgets
fclose
rewind
_errno
sprintf
isspace
_write
_strnicmp
_iob
fprintf
isdigit
isxdigit
islower
wcscpy
ntdll
NtSetIoCompletion
NtRemoveIoCompletion
NtClose
NtSetInformationFile
NtCreateEvent
RtlFreeHeap
NtDeviceIoControlFile
RtlInitializeCriticalSectionAndSpinCount
NtOpenKey
RtlInitUnicodeString
RtlRegisterSecureMemoryCacheCallback
RtlQueryRegistryValues
RtlGetNtProductType
NtSetInformationObject
NtCreateFile
RtlAllocateHeap
NtCancelIoFile
RtlDeleteCriticalSection
NtSetEvent
RtlRaiseStatus
NtWaitForSingleObject
NtDelayExecution
NtLoadDriver
RtlAdjustPrivilege
RtlImpersonateSelf
NtQuerySystemTime
NtCreateIoCompletion
NtAlertThread
NtQueueApcThread
NtClearEvent
RtlNtStatusToDosError
NtReadFile
NtWaitForMultipleObjects
NtQueryEvent
NtQueryInformationFile
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFreeAnsiString
RtlDestroyHeap
RtlCreateHeap
RtlDeregisterWaitEx
RtlQueueWorkItem
RtlRegisterWait
NtCreateWaitablePort
NtRequestWaitReplyPort
NtConnectPort
NtReplyPort
RtlIpv6StringToAddressA
RtlIpv6StringToAddressW
RtlIpv6StringToAddressExA
RtlIpv6StringToAddressExW
RtlInitString
NtQueryValueKey
NtAcceptConnectPort
NtReplyWaitReceivePortEx
NtCompleteConnectPort
NtDuplicateObject
NtResetEvent
kernel32
LocalAlloc
LocalFree
FormatMessageA
ReadFile
WriteFile
SetConsoleMode
GetConsoleMode
CreateFileA
ExpandEnvironmentStringsA
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DelayLoadFailureHook
GetComputerNameExA
WriteProcessMemory
GetCurrentThreadId
IsBadCodePtr
ResetEvent
SwitchToThread
HeapCreate
HeapAlloc
CreateFileMappingA
MapViewOfFile
GetProcessHeap
HeapDestroy
HeapFree
UnmapViewOfFile
VirtualFree
GetSystemInfo
FormatMessageW
lstrcmpW
TerminateThread
ResumeThread
lstrlenW
lstrcpyW
VirtualAlloc
LCMapStringW
WaitForMultipleObjects
CreateEventW
WideCharToMultiByte
MultiByteToWideChar
GetOverlappedResult
OpenProcess
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
IsBadWritePtr
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
CreateThread
InterlockedExchangeAdd
GetCurrentThread
SetThreadPriority
FreeLibraryAndExitThread
OutputDebugStringA
SleepEx
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LoadLibraryA
GetLastError
Sleep
SetLastError
SetEvent
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObjectEx
GetTickCount
CreateEventA
GetModuleHandleExA
LoadLibraryW
ExpandEnvironmentStringsW
WaitForSingleObject
OpenEventW
PostQueuedCompletionStatus
CreateIoCompletionPort
advapi32
GetUserNameA
RegQueryValueExW
RegOpenKeyExW
RevertToSelf
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegSetValueExA
SetServiceStatus
DeregisterEventSource
RegNotifyChangeKeyValue
RegCreateKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
RegisterServiceCtrlHandlerA
CloseServiceHandle
RegisterEventSourceA
ReportEventA
RegDeleteValueW
RegOpenCurrentUser
RegQueryInfoKeyA
RegEnumValueW
OpenSCManagerA
OpenServiceA
StartServiceA
QueryServiceStatus
RegCloseKey
rpcrt4
UuidCreate
UuidToStringW
RpcStringFreeW
UuidFromStringW
ws2_32
accept
ntohs
recv
htons
bind
listen
send
closesocket
connect
gethostbyname
WSASocketW
WSAStartup
WSCGetProviderPath
WSCEnumProtocols
inet_ntoa
ntohl
WSAIoctl
WSAEnumProtocolsW
inet_addr
select
getsockname
getnameinfo
WSACleanup
WSAGetLastError
socket
WSAIsBlocking
WSARecv
gethostname
WSCInstallProvider
WSCDeinstallProvider
WSCUpdateProvider
WSCWriteProviderOrder
getservbyport
getservbyname
WSAProviderConfigChange
ws2help
WahRemoveHandleContext
WahReferenceContextByHandle
WahInsertHandleContext
WahEnumerateHandleContexts
WahCreateHandleContextTable
WahDestroyHandleContextTable
Exports
Exports
AcceptEx
EnumProtocolsA
EnumProtocolsW
GetAcceptExSockaddrs
GetAddressByNameA
GetAddressByNameW
GetNameByTypeA
GetNameByTypeW
GetServiceA
GetServiceW
GetTypeByNameA
GetTypeByNameW
MigrateWinsockConfiguration
NPLoadNameSpaces
NSPStartup
ServiceMain
SetServiceA
SetServiceW
StartWsdpService
StopWsdpService
SvchostPushServiceGlobals
TransmitFile
WSARecvEx
WSPStartup
dn_expand
getnetbyname
inet_network
rcmd
rexec
rresvport
s_perror
sethostname
Sections
.text Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
SANONTCP Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ