e:\VCTest\ASXZ\Release\ASXZ.pdb
Static task
static1
Behavioral task
behavioral1
Sample
45c184d275178acae935a6c403b67f1e_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
45c184d275178acae935a6c403b67f1e_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
45c184d275178acae935a6c403b67f1e_JaffaCakes118
-
Size
92KB
-
MD5
45c184d275178acae935a6c403b67f1e
-
SHA1
0531972309d7d44d4cff7716bac41bd9db45af74
-
SHA256
4040a384d45c7c504ae061bbaaaa8b24f73abf12acb8003f1624ad904d1158ce
-
SHA512
3602c05af64e50388ef278a1dd6f96b86588de32f8d37d44f118de17d93b6704fad3efd61bd54219df1bb508fe1c595ff73736a3baad0ed740dd2e96e57abeab
-
SSDEEP
1536:i+aNo18X7ihP/riD9Hix/2tqierpBxMg3jEvmLZOWhZn1qK6T:ic18L4/ri8dyqiepMgz9OWhZl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 45c184d275178acae935a6c403b67f1e_JaffaCakes118
Files
-
45c184d275178acae935a6c403b67f1e_JaffaCakes118.dll windows:4 windows x86 arch:x86
abb20b2f368504fbbd6b5b10887a7734
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
psapi
GetModuleFileNameExA
mfc80
ord910
ord911
ord907
ord2469
ord371
ord1917
ord1167
ord1120
ord5491
ord1175
ord1177
ord314
ord1209
ord581
ord1092
ord1037
ord864
ord2467
ord293
ord283
ord577
ord900
ord903
ord898
ord1208
ord1488
ord1084
ord315
ord765
ord6754
ord282
ord6704
ord4038
ord4014
ord6278
ord3801
ord6276
ord4326
ord2063
ord2018
ord5583
ord3806
ord1010
ord5102
ord6219
ord5382
ord3832
ord1920
ord2931
ord5224
ord5226
ord2248
ord3948
ord4568
ord5230
ord5213
ord5566
ord2537
ord2731
ord2835
ord4307
ord2714
ord2838
ord2540
ord2646
ord2533
ord3718
ord3719
ord3709
ord2644
ord3949
ord4481
ord4261
ord3333
ord3830
ord757
ord566
ord3683
ord784
ord2320
ord265
ord2322
ord578
ord310
ord764
ord1098
ord1201
ord1206
msvcr80
__clean_type_info_names_internal
memcpy
_wcsnicmp
_strnicmp
_stricmp
_crt_debugger_hook
?terminate@@YAXXZ
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
??2@YAPAXI@Z
__CxxFrameHandler3
free
_wtoi
iswdigit
wcsncmp
wcsncpy
_strupr
strncpy
memset
_initterm_e
?_type_info_dtor_internal_method@type_info@@QAEXXZ
kernel32
FreeLibraryAndExitThread
ExitProcess
IsBadReadPtr
CreateThread
Sleep
FormatMessageA
LocalFree
lstrcmpA
LocalAlloc
CreateFileA
GetLastError
CopyFileA
TerminateProcess
InterlockedExchange
GetCurrentProcess
VirtualQuery
ReadProcessMemory
GetTickCount
GetModuleHandleExA
GetCurrentProcessId
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualProtectEx
VirtualAllocEx
OpenProcess
LoadLibraryA
GetProcAddress
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualProtect
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedCompareExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
GetVersionExA
user32
wsprintfA
MessageBoxW
MessageBoxA
advapi32
ControlService
StartServiceA
QueryServiceConfigA
OpenServiceA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
DeleteService
Sections
.text Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ