msdbxi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2ff33547c079046403b0232793b7bd15_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
2ff33547c079046403b0232793b7bd15_JaffaCakes118
-
Size
327KB
-
MD5
2ff33547c079046403b0232793b7bd15
-
SHA1
520cf383bbe4cb2137d44be447c9ff7696183458
-
SHA256
80ab9194d8d92200177268c571b9e5daedeba2a61b666cda9c2aa9ca4bd69b2b
-
SHA512
12f6118a1534b52926dda452154d8760afed5553a9da26fbb17b36773100152971525451c43097ee4cf21421e1585a52232abc844ef0ec9a6c76f6e1db35492b
-
SSDEEP
6144:UJmQThiYjRQST0zgvo3zF9B6gU4nZf5qj77caV6NOMTMZ62rscrTZh/T1:IiYd6Mg3zN6h4nZhgHcGWN2rscrTZRT1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ff33547c079046403b0232793b7bd15_JaffaCakes118
Files
-
2ff33547c079046403b0232793b7bd15_JaffaCakes118.dll windows:5 windows x86 arch:x86
833df35bef90dec42bbb37c34d3c9207
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntdll
RtlUnwind
kernel32
GetStdHandle
InterlockedExchange
GetACP
GetLocaleInfoA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
GetSystemInfo
InterlockedIncrement
InterlockedDecrement
CloseHandle
WaitForSingleObject
SetEvent
LeaveCriticalSection
CreateThread
CreateEventW
EnterCriticalSection
UnmapViewOfFile
FlushViewOfFile
HeapAlloc
HeapFree
GetCurrentThreadId
Sleep
ReleaseMutex
GetCurrentProcessId
HeapDestroy
GetLastError
SetEndOfFile
SetFilePointer
lstrlenA
HeapCreate
CreateMutexW
MoveFileW
DeleteFileW
lstrlenW
CreateFileW
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
GetFileSize
MulDiv
GetDiskFreeSpaceA
WideCharToMultiByte
GetFullPathNameW
MultiByteToWideChar
CompareFileTime
lstrcmpiA
lstrcmpA
GetStringTypeExA
IsDBCSLeadByte
GetCommandLineA
GetVersionExA
VirtualQuery
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
HeapSize
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
SetUnhandledExceptionFilter
GetOEMCP
GetCPInfo
LoadLibraryA
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
VirtualProtect
ole32
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
user32
SetWindowLongW
GetWindowLongW
PostMessageW
PeekMessageW
GetMessageW
IsWindow
CharLowerW
RegisterClassW
TranslateMessage
CreateWindowExW
CharUpperA
DispatchMessageW
DestroyWindow
DefWindowProcW
PostThreadMessageW
UnregisterClassW
SendMessageTimeoutW
GetClassInfoW
shlwapi
StrStrA
StrStrIA
wnsprintfW
PathRenameExtensionW
PathFileExistsW
StrCpyNW
StrCmpIW
StrToIntExA
StrCmpW
Exports
Exports
CreateDatabaseSession
DbxDllMain
Sections
.text Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 245KB - Virtual size: 248KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE