c:\Fujisan\WeatherPlugin\Release\WeatherPlugin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
04ef7fc784cc4d59eb8c6aac1e3540b1_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
04ef7fc784cc4d59eb8c6aac1e3540b1_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
04ef7fc784cc4d59eb8c6aac1e3540b1_JaffaCakes118
-
Size
263KB
-
MD5
04ef7fc784cc4d59eb8c6aac1e3540b1
-
SHA1
0af4d950ae7d7b94b15ca2b1776f8ce54fe03d4f
-
SHA256
d84fda6da27b1e97980826671adf442b2a728b08d253dd8b1063f2d19ddca8d6
-
SHA512
25670c4d522363df0ae5ba8fdc11fbb28a6c3791707cfc2d4d21a5558049e93c8678071d3007acebec30f22e9a46407e5938df3e7a3dfee986e36e20aaa2d593
-
SSDEEP
3072:o2i2qSSc2tduK6p+T2qIQFqZyIBH844rZnbiWvHrMGx2r4zWDVlFPW/vUzcj+pj:oTbd361qCZ3Bc44rFksIj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04ef7fc784cc4d59eb8c6aac1e3540b1_JaffaCakes118
Files
-
04ef7fc784cc4d59eb8c6aac1e3540b1_JaffaCakes118.dll windows:4 windows x86 arch:x86
2cbcbdca5b81154145b5494c8d263cf8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CreateFileA
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetStringTypeA
GetTickCount
QueryPerformanceCounter
GetTimeZoneInformation
HeapCreate
SetFilePointer
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetConsoleMode
GetConsoleCP
MultiByteToWideChar
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
LockResource
WideCharToMultiByte
FindResourceExW
Sleep
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
SetLastError
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
RaiseException
GetStringTypeW
RtlUnwind
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
VirtualQuery
GetSystemInfo
GetModuleHandleA
VirtualProtect
GetCurrentProcessId
GetCommandLineA
GetSystemTimeAsFileTime
CreateThread
LoadResource
SizeofResource
ExitThread
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
lstrlenW
FindResourceW
GetModuleHandleW
GetLastError
MulDiv
CloseHandle
lstrcmpW
WriteFile
CreateFileW
lstrcpyW
ResumeThread
CreateMutexW
WaitForSingleObject
ReleaseMutex
TerminateThread
lstrlenA
GetFileAttributesW
SetFileAttributesW
DeleteFileW
CreateDirectoryW
GetPrivateProfileStringW
MoveFileExW
GetFileAttributesExW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFullPathNameW
GetProcAddress
LoadLibraryW
FreeLibrary
GetVersionExW
GlobalUnlock
GlobalLock
GlobalAlloc
GetVersionExA
user32
SetWindowLongW
TranslateMessage
ReleaseDC
DispatchMessageW
MessageBoxA
CopyRect
IsWindow
DestroyMenu
GetMenuItemCount
KillTimer
SendMessageW
SetTimer
RedrawWindow
CreatePopupMenu
GetParent
GetClassInfoExW
CallWindowProcW
GetAncestor
wsprintfW
PostMessageW
GetWindow
GetMessageW
GetWindowLongW
EndPaint
BeginPaint
InvalidateRect
GetClientRect
GetWindowRect
LoadBitmapW
SetWindowPos
DestroyWindow
ShowWindow
CreateWindowExW
DrawTextW
WindowFromDC
ClientToScreen
ScreenToClient
EndMenu
GetCursorPos
PtInRect
GetSystemMetrics
FindWindowW
AppendMenuW
OffsetRect
TrackPopupMenuEx
FillRect
GetSysColor
InflateRect
GetMenuItemInfoW
SetMenuItemInfoW
MessageBoxW
MonitorFromPoint
GetMonitorInfoW
GetMenuItemRect
GetKeyState
GetClassNameW
GetDesktopWindow
wsprintfA
EnableWindow
EqualRect
IsWindowVisible
GetActiveWindow
IsChild
GetSysColorBrush
SetWindowTextW
MonitorFromRect
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
CreateAcceleratorTableW
CharNextW
InvalidateRgn
DestroyAcceleratorTable
ReleaseCapture
SetCapture
GetDlgItem
MoveWindow
GetWindowTextLengthW
GetWindowTextW
RegisterWindowMessageW
SetFocus
GetFocus
GetCapture
SetCursor
UpdateWindow
SetRect
SetClassLongW
SetLayeredWindowAttributes
GetClassLongW
UnregisterClassA
RegisterClassExW
LoadCursorW
GetDC
DefWindowProcW
SystemParametersInfoW
PostQuitMessage
gdi32
CreateFontIndirectW
DeleteObject
BitBlt
SetBkMode
SetBkColor
SetTextColor
GetBkColor
GetTextColor
GetCurrentObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
Rectangle
LineTo
GetDeviceCaps
DPtoLP
ExtTextOutW
CreateSolidBrush
SetViewportOrgEx
CreateBitmap
MoveToEx
GetStockObject
GetObjectW
CreatePen
DeleteDC
ole32
CoUninitialize
CreateStreamOnHGlobal
OleUninitialize
OleLockRunning
CoGetClassObject
OleInitialize
CoTaskMemAlloc
StringFromGUID2
CoInitialize
OleRun
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
CoCreateInstance
oleaut32
GetErrorInfo
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayCreate
SysAllocStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocString
SysAllocStringByteLen
OleCreateFontIndirect
SysStringByteLen
SysStringLen
SysFreeString
DispCallFunc
VariantInit
VariantClear
VariantCopy
VariantChangeType
shlwapi
PathFindFileNameW
SHGetValueW
PathAddBackslashW
urlmon
ObtainUserAgentString
UrlMkSetSessionOption
comctl32
InitCommonControlsEx
wininet
HttpSendRequestW
InternetCrackUrlW
InternetReadFile
InternetOpenW
InternetOpenUrlW
InternetGetConnectedState
InternetCloseHandle
InternetGetCookieW
HttpOpenRequestW
InternetConnectW
InternetGoOnlineW
HttpQueryInfoW
advapi32
RegOpenKeyExW
RegEnumValueW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
shell32
SHGetSpecialFolderPathW
Exports
Exports
CreatePlugin
Sections
.text Size: 205KB - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ