d:\업무관련\ibluechip\03\12_20110217_야후수정(utf-8)\bluechip\bluechip\release\bluechip.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3acfdaf3231eb691a50dc93caac7bd3e_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
3acfdaf3231eb691a50dc93caac7bd3e_JaffaCakes118
-
Size
188KB
-
MD5
3acfdaf3231eb691a50dc93caac7bd3e
-
SHA1
f17b74b7c6e0a5abef990f31cd15ae3b7a085568
-
SHA256
05b2042adc3a2b7d6b844e78697882167fddfc5d7d321d1e15b135c32b7931ea
-
SHA512
e662853e25c878d454a5444cc70b444228fa992aab81a9863628cc9312f472538dbc580bfacbcc158149bfde90425efaafe815c39b9ecb6fa3c4e3c555c03c0a
-
SSDEEP
3072:90oPg/Q+5LCbP8DRtVpEMDNmx58batAV0j2QI2zV5DPhzSQAQXs/:Xo/QMCPKXednyatAVU2Qnztb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3acfdaf3231eb691a50dc93caac7bd3e_JaffaCakes118
Files
-
3acfdaf3231eb691a50dc93caac7bd3e_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
5a1540b9a3e8dc762027c9f39c4127b5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
wininet
DeleteUrlCacheEntry
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetQueryDataAvailable
InternetReadFile
InternetCloseHandle
shlwapi
PathFileExistsA
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
urlmon
URLDownloadToFileA
kernel32
LCMapStringA
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrlenA
lstrcmpiA
GetModuleFileNameA
IsDBCSLeadByte
InterlockedIncrement
InterlockedDecrement
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
SetThreadLocale
GetThreadLocale
GetVersionExA
GetFileAttributesA
LCMapStringW
DebugBreak
OutputDebugStringA
CloseHandle
ReadFile
CreateFileA
GetLocalTime
DeleteFileA
CreateDirectoryA
GetProcAddress
LoadLibraryW
InterlockedExchange
GetACP
GetLocaleInfoA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetFilePointer
GetStartupInfoA
GetFileType
SetHandleCount
GetStringTypeW
GetStringTypeA
IsValidCodePage
GetOEMCP
GetCPInfo
Sleep
HeapSize
GetConsoleMode
SetStdHandle
FlushFileBuffers
GetConsoleCP
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStdHandle
WriteFile
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
GetCommandLineA
GetCurrentThreadId
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
user32
SendMessageA
CharLowerA
GetSystemMetrics
GetFocus
CallNextHookEx
SetWindowsHookExA
FindWindowExA
GetWindowRect
GetCursorPos
LoadStringA
UnhookWindowsHookEx
wsprintfA
SetWindowPos
UnregisterClassA
FindWindowA
CharNextA
advapi32
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA
ole32
CoInitialize
CoUninitialize
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
shell32
ShellExecuteA
SHGetSpecialFolderPathA
oleaut32
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VariantInit
VariantChangeType
VariantCopy
VariantClear
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 136KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ