E:\build\SmartEngine\Bin\Win32\Release\EXEngine.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4a91e3a23440d16fbcba9b10b54dee53_JaffaCakes118.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
4a91e3a23440d16fbcba9b10b54dee53_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
4a91e3a23440d16fbcba9b10b54dee53_JaffaCakes118
-
Size
397KB
-
MD5
4a91e3a23440d16fbcba9b10b54dee53
-
SHA1
d297b74c85b5fb748d8a2807b49558b0a9f3fd3a
-
SHA256
4fb5d550e999dbd751beea4ad677ded8157fca2a5de8c36534954b78d21f4e00
-
SHA512
cd0c7af1d0d54924f5ee28a5ffe6ce15a2d624156cb4f6782edac64f58ed8aeb2211e37d44f0602b9853773a401ad4e3dd0328e2a378ffb1df587b626205063d
-
SSDEEP
6144:ph7AgrNRbjNb0OXUFMoi2combwPYNRRlAssavROgDG0pdq12C:zBXbjNb0OXUFMoi2coOYYnRlYaQgxC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a91e3a23440d16fbcba9b10b54dee53_JaffaCakes118
Files
-
4a91e3a23440d16fbcba9b10b54dee53_JaffaCakes118.dll windows:5 windows x86 arch:x86
1f25fdadc4e4e22287d406de5a4c3ffd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
TerminateProcess
GetCurrentProcess
FindResourceA
FindResourceExA
TlsSetValue
TlsGetValue
HeapFree
GetProcessHeap
HeapAlloc
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
LocalAlloc
LocalFree
GetLogicalDrives
GetDriveTypeW
GetDiskFreeSpaceExW
SetUnhandledExceptionFilter
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
InterlockedExchange
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
LoadLibraryA
GetFileSize
CreateMutexW
SetFilePointer
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
RemoveDirectoryW
DeviceIoControl
GetNativeSystemInfo
GetOverlappedResult
GetModuleHandleA
RaiseException
IsDebuggerPresent
GetQueuedCompletionStatus
WaitForSingleObjectEx
WaitForMultipleObjectsEx
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
PostQueuedCompletionStatus
CreateIoCompletionPort
DeleteCriticalSection
FreeLibrary
VirtualFree
VirtualAlloc
TlsAlloc
GetThreadLocale
GetSystemDefaultLCID
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WriteFile
ReadFile
SetEndOfFile
SetFilePointerEx
GetFileSizeEx
CreateFileW
GetVersionExW
CreateDirectoryW
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
InterlockedDecrement
InterlockedIncrement
MoveFileExW
ExitProcess
GetWindowsDirectoryW
CopyFileW
GetSystemDirectoryW
GetModuleFileNameW
OpenEventW
Sleep
GetLastError
UnregisterWaitEx
CloseHandle
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
GetModuleHandleW
GetProcAddress
GetPrivateProfileSectionW
DeleteFileW
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
SetLastError
SetFileAttributesW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesExW
MoveFileW
QueryDosDeviceW
ExpandEnvironmentStringsW
lstrcpyW
lstrlenW
SetErrorMode
GetProcessId
TerminateThread
ReleaseMutex
ExitThread
GetSystemInfo
VirtualProtect
CreateEventA
ResetEvent
CreateSemaphoreA
ReleaseSemaphore
HeapDestroy
HeapReAlloc
HeapSize
UnhandledExceptionFilter
GetCommandLineA
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsFree
HeapCreate
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetUserDefaultLCID
GetLocaleInfoA
advapi32
RegOpenKeyW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
DeleteAce
GetAce
GetNamedSecurityInfoW
AdjustTokenPrivileges
LookupPrivilegeValueW
QueryServiceStatus
CreateServiceW
DeleteService
ControlService
ChangeServiceConfigW
RegEnumKeyExW
RegQueryValueExW
RegEnumValueW
RegEnumKeyW
RegCloseKey
RegOpenKeyExW
LookupAccountSidW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ChangeServiceConfig2W
QueryServiceStatusEx
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegCreateKeyW
ntdll
RtlUnwind
NtQueryDirectoryFile
NtSetInformationFile
NtQueryInformationFile
NtWriteFile
NtReadFile
NtOpenFile
NtCreateFile
NtEnumerateValueKey
NtEnumerateKey
NtSetValueKey
NtQueryValueKey
NtDeleteValueKey
NtDeleteKey
NtCreateKey
NtOpenKey
RtlEqualUnicodeString
RtlDetermineDosPathNameType_U
RtlCompareMemory
RtlIsDosDeviceName_U
NtWaitForSingleObject
RtlDosPathNameToNtPathName_U
RtlUnicodeStringToAnsiString
RtlAllocateHeap
RtlFreeHeap
RtlCreateUnicodeString
RtlNtStatusToDosError
RtlDeleteCriticalSection
NtClose
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlInitializeCriticalSection
RtlOpenCurrentUser
RtlFreeUnicodeString
RtlUnicodeStringToInteger
RtlInitUnicodeString
RtlUpcaseUnicodeChar
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlCharToInteger
Exports
Exports
EZCloseHandle
EZExtractFile
EZOpenHandle
Is64System
LZMACloseHandle
LZMAEncodeFile
LZMAOpenHandle
ServiceMain
SvchostPushServiceGlobals
Sections
.text Size: 314KB - Virtual size: 314KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ