E:\游锦华\我的工程\SVN\Hijackthis\IeHelpV2\Release\IeHelpV2.pdb
Static task
static1
Behavioral task
behavioral1
Sample
17ce361453732efdc83e1668cdb7b640_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
17ce361453732efdc83e1668cdb7b640_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
17ce361453732efdc83e1668cdb7b640_JaffaCakes118
-
Size
300KB
-
MD5
17ce361453732efdc83e1668cdb7b640
-
SHA1
3777ede7d10049c9f601fdc710213c2d709a2501
-
SHA256
0b740af4a5dd8159935d68be2232ad8ba0cad06c31c7b2a5bfd486d6f524ed87
-
SHA512
b123bc4a87ab9b036696dda1a79b8439c625ac8856d45512452fa7c29e60f043c5a63819f5f832d6d8028e642f9307560ad6513cd4283044b315e3cd4c9d885c
-
SSDEEP
6144:1iPkXtQ+SGw+P3iAf1VgCr6Q06M3XfssR9kSTY15XNfym:1iPkdQNGX/iA3gCrq7XfssR9VoNfR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17ce361453732efdc83e1668cdb7b640_JaffaCakes118
Files
-
17ce361453732efdc83e1668cdb7b640_JaffaCakes118.dll windows:5 windows x86 arch:x86
75c030069467bcec5a78523db2569330
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
shlwapi
StrStrIA
StrCmpNIA
kernel32
CloseHandle
VirtualProtect
DisableThreadLibraryCalls
GetModuleFileNameW
lstrcmpW
WideCharToMultiByte
MultiByteToWideChar
SetLastError
LocalAlloc
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCurrentProcessId
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
GetModuleHandleA
UnmapViewOfFile
MapViewOfFile
FlushInstructionCache
GetCurrentProcess
IsBadReadPtr
GetModuleHandleW
VirtualFree
Sleep
CreateFileMappingA
lstrlenW
GetVersion
CreateFileMappingW
CreateFileW
GetProcAddress
VirtualQuery
GetModuleFileNameA
ReadProcessMemory
ReleaseMutex
WaitForSingleObject
LoadLibraryW
CreateMutexW
lstrcatA
GetThreadContext
OpenMutexW
VirtualAlloc
OpenFileMappingW
CreateEventW
OpenEventW
VirtualAllocEx
VirtualQueryEx
VirtualFreeEx
OpenProcess
VirtualProtectEx
WriteProcessMemory
HeapAlloc
GetProcessHeap
HeapFree
CreateRemoteThread
IsBadWritePtr
GetExitCodeThread
GetWindowsDirectoryW
lstrcpyW
WriteConsoleW
FlushFileBuffers
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
HeapCreate
GetUserDefaultLCID
InterlockedExchange
GetConsoleMode
GetConsoleCP
GetStringTypeW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
LCMapStringW
SetFilePointer
GetLocaleInfoW
GetStartupInfoW
GetFileType
TerminateThread
GetCurrentThread
lstrcpyA
LocalFree
GetLastError
GetTickCount
lstrlenA
HeapDestroy
ExitProcess
DuplicateHandle
CompareStringW
SetHandleCount
RaiseException
IsProcessorFeaturePresent
GetStdHandle
DecodePointer
EncodePointer
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
WriteFile
user32
WindowFromPoint
SendMessageW
CharUpperW
CharLowerW
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
GetThreadDesktop
CallNextHookEx
GetWindowLongW
SetWindowsHookExW
UnhookWindowsHookEx
GetFocus
GetParent
FindWindowW
GetClassNameW
GetCursorPos
GetWindowThreadProcessId
PostMessageW
FindWindowExA
GetDesktopWindow
FindWindowExW
FindWindowA
advapi32
GetKernelObjectSecurity
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
OpenProcessToken
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegOpenKeyW
RegQueryValueExW
GetLengthSid
Sections
.text Size: 219KB - Virtual size: 218KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
MyShared Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ