c:\documents and settings\jo\바탕 화면\posneserv\release\posneserv.pdb
Static task
static1
Behavioral task
behavioral1
Sample
28d8f1f214234dd84791c7700a825d2d_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
28d8f1f214234dd84791c7700a825d2d_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
28d8f1f214234dd84791c7700a825d2d_JaffaCakes118
-
Size
92KB
-
MD5
28d8f1f214234dd84791c7700a825d2d
-
SHA1
25148f0b32b60989c1acebac4f4ddc35ddd69094
-
SHA256
669f944d0fe460833e56d3d061d0f9bf8b7fbc1d8540a6a6149c21bb1a5debf6
-
SHA512
32006199b22e7ad5544c800345632dbeff34e2c14eb4ac04244a7c84b36b56cb93377c92fca52ba584aa28a29cdc9b40d8b168185bb5456c4685c8b4896cccda
-
SSDEEP
768:408q0Bfi+A5Vu7A/4OIOq4ffEYhKBzxsQuQZtkZu6VfZ0QszLAlcZsq97oyl0gL/:CqQq+A5AmiOxsYQwQFkZkB7Q6QMG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28d8f1f214234dd84791c7700a825d2d_JaffaCakes118
Files
-
28d8f1f214234dd84791c7700a825d2d_JaffaCakes118.dll windows:4 windows x86 arch:x86
49570ad3d40a057bed5789863e000cb9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
wininet
InternetReadFile
InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetCloseHandle
DeleteUrlCacheEntry
InternetQueryDataAvailable
HttpSendRequestA
urlmon
URLDownloadToFileA
kernel32
WriteConsoleA
RaiseException
SetStdHandle
Sleep
lstrlenA
LoadResource
LockResource
SizeofResource
FindResourceA
FindResourceExA
GetLastError
InterlockedExchange
GetConsoleOutputCP
CompareStringA
LoadLibraryA
CompareStringW
FreeLibrary
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
GetLocaleInfoA
WriteConsoleW
SetEnvironmentVariableA
CreateFileA
CloseHandle
FlushFileBuffers
GetThreadLocale
GetProcAddress
GetCommandLineA
GetStringTypeW
GetStringTypeA
LCMapStringW
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapAlloc
HeapFree
VirtualAlloc
GetModuleHandleA
GetLocalTime
GetTimeZoneInformation
GetCurrentThreadId
LCMapStringA
GetProcessHeap
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapCreate
VirtualFree
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
RtlUnwind
SetFilePointer
user32
UnregisterClassA
advapi32
RegCreateKeyExA
RegisterServiceCtrlHandlerExA
StartServiceCtrlDispatcherA
RegCloseKey
RegSetValueExA
RegQueryValueExA
SetServiceStatus
shell32
ShellExecuteA
SHGetSpecialFolderPathA
Exports
Exports
ServiceMain
_HandlerEx@16
Sections
.text Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ