Y:\Mars\Release\Header2.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0fd5a08c6724171d89aef48d6130c2f6_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0fd5a08c6724171d89aef48d6130c2f6_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0fd5a08c6724171d89aef48d6130c2f6_JaffaCakes118
-
Size
106KB
-
MD5
0fd5a08c6724171d89aef48d6130c2f6
-
SHA1
6fc30be209bca2dfeb4a87eb3dbab1481613f279
-
SHA256
e7296898634cf7f57fcbded975ed671f7bbbe6f1a541039c944603f1c8bb329b
-
SHA512
a2fa842ff1a48223ad7ec59561c7c1c2d781e39cce2ca30859c991752675e87772e30c6fc25931969d1894fb226e74a38526ce75d139315e59cba84b9abb6b7a
-
SSDEEP
1536:jWqLFKtSZJJg2pSFKSZaifVWG0cYgv7kk9FnzwlVLsOhmL9y1:/LSSZJJg2AFhlx0jlZsomL9y1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0fd5a08c6724171d89aef48d6130c2f6_JaffaCakes118
Files
-
0fd5a08c6724171d89aef48d6130c2f6_JaffaCakes118.dll windows:5 windows x86 arch:x86
83555b4873cebcd50ebe80b3f3c918ef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
SetFilePointer
WriteFile
FlushFileBuffers
GetFileSize
lstrcatA
GetTickCount
LoadLibraryA
GetProcAddress
FreeLibrary
VirtualAlloc
lstrcmpiA
ReadFile
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateDirectoryA
SetFileAttributesA
FindFirstFileA
GetLastError
FindNextFileA
FindClose
GetFileAttributesA
CompareStringW
CreateFileW
CreateFileA
lstrcpyA
DeleteFileA
GetTempPathA
GetModuleFileNameA
GetPrivateProfileStringA
GetSystemDirectoryA
Sleep
GetPrivateProfileIntA
GetCurrentProcess
SetErrorMode
lstrcpynA
lstrlenA
ExitProcess
VirtualFree
WideCharToMultiByte
GetStringTypeW
LCMapStringW
MultiByteToWideChar
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
HeapReAlloc
SetEnvironmentVariableA
RtlUnwind
IsValidCodePage
GetOEMCP
HeapAlloc
HeapFree
ExitThread
GetCurrentThreadId
CreateThread
GetSystemTimeAsFileTime
DecodePointer
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
EncodePointer
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetTimeZoneInformation
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
LoadLibraryW
HeapSize
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
user32
wsprintfA
advapi32
CryptGetHashParam
CryptVerifySignatureA
CryptImportKey
CryptReleaseContext
CryptDestroyHash
CryptDestroyKey
CryptDecrypt
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextA
RegCloseKey
RegOpenKeyExW
RegEnumValueA
shell32
SHCreateDirectoryExA
ws2_32
socket
connect
WSAStartup
closesocket
gethostbyname
recv
send
htons
shlwapi
PathRemoveFileSpecA
StrStrA
StrStrIA
Exports
Exports
OnInject
ServiceMain
start
Sections
.text Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ