i:\1传奇外传资料\A备份\1移动单\lele二代\m16魔兽世界VC2005\wow防D-SSSWF版\wowpic\release\MWDL.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1223e42881162b6b16afdfcff353902e_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1223e42881162b6b16afdfcff353902e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
1223e42881162b6b16afdfcff353902e_JaffaCakes118
-
Size
48KB
-
MD5
1223e42881162b6b16afdfcff353902e
-
SHA1
74aa172ce26b18f22ae5c89d62a20f6446e84adb
-
SHA256
12d546d4d5122daf48d1e56451d95265d8892afccfacdcfbd013d0479ea4fed5
-
SHA512
30f45a5c6d0a13995b96a7baf819dd1b01e9bd70595c9b1b2b819882fb840245cfa1d786f123efd2cc495f58ceb56087a849a7f9e5fa58e2e3b1f30e3c5d17c0
-
SSDEEP
768:zYdoNQIO3gM+Z2Vu8g/t6heNaWbO/fyqlQ0ysbKPNCXUKc/KKaU:zYo16cNBbC1bKPcYKLU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1223e42881162b6b16afdfcff353902e_JaffaCakes118
Files
-
1223e42881162b6b16afdfcff353902e_JaffaCakes118.dll windows:4 windows x86 arch:x86
d6bf947c87b92b357be41b2ecc765a89
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
lstrcpynA
CreateFileA
ReadFile
GetFileSize
CloseHandle
GetTempPathA
DeleteFileA
MultiByteToWideChar
GlobalAlloc
GlobalLock
WriteFile
GlobalUnlock
GlobalFree
CreateToolhelp32Snapshot
Process32First
GetTickCount
VirtualAlloc
GetModuleHandleA
GetPrivateProfileStringA
CreateThread
WideCharToMultiByte
GetSystemTime
WritePrivateProfileStringA
GetModuleFileNameA
SetFilePointer
CreateMutexA
GetLastError
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
lstrcmpiA
lstrlenA
ExitProcess
lstrcmpA
Sleep
VirtualProtect
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcatA
GetSystemDirectoryA
Process32Next
OutputDebugStringA
user32
PostThreadMessageA
SetWindowsHookExA
CallNextHookEx
GetSystemMetrics
EnumWindows
GetDC
ReleaseDC
IsRectEmpty
GetWindowTextA
IsWindowVisible
IsIconic
GetActiveWindow
ShowWindow
SetForegroundWindow
FindWindowA
FindWindowExA
GetWindowThreadProcessId
GetWindowInfo
PrintWindow
gdi32
GetDIBits
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetObjectA
CreateDCA
GetDeviceCaps
DeleteDC
GetStockObject
SelectPalette
RealizePalette
ws2_32
inet_ntoa
gethostbyname
gdiplus
GdipGetImageEncoders
GdipSaveImageToFile
GdipCloneImage
GdipLoadImageFromFile
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipGetImageEncodersSize
wininet
InternetOpenA
InternetCloseHandle
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
HttpEndRequestA
msvcrt
??2@YAPAXI@Z
??3@YAXPAX@Z
atoi
malloc
free
memmove
strstr
sprintf
??1type_info@@UAE@XZ
memset
memcpy
_except_handler3
_local_unwind2
Exports
Exports
HHHH
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
UUUU
Sections
.text Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ