perivate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
56e31eed8bb950f4a7d3b7510feea597_JaffaCakes118.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
56e31eed8bb950f4a7d3b7510feea597_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
56e31eed8bb950f4a7d3b7510feea597_JaffaCakes118
-
Size
78KB
-
MD5
56e31eed8bb950f4a7d3b7510feea597
-
SHA1
be40dff65908cf6b8500955053c48eceb9bda186
-
SHA256
e576411e26bc09f2b6a296855c8e68002b086c67fd70ac1716eeb648c346ba87
-
SHA512
b7b559ed9841f9900d95b7bce5a2c69a9a89c76caa984236dde6c0b71ed60c28c8c9b8abd83202c38faea4600e089093449e1501595ce5bdfa998da3abca1b5a
-
SSDEEP
1536:LaejhwzMyaS47KZNw0KHxRiP1zAxfc/3ieW9qW/8PRgHFBn/:t+BaS47KZtP1zAxixW+yn/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 56e31eed8bb950f4a7d3b7510feea597_JaffaCakes118
Files
-
56e31eed8bb950f4a7d3b7510feea597_JaffaCakes118.dll windows:4 windows x86 arch:x86
01903f95b4098179c15cba95c002eeed
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
shlwapi
StrRetToBufW
UrlCreateFromPathW
UrlCombineW
StrPBrkW
kernel32
GetNumberFormatA
InterlockedIncrement
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
GetSystemTimeAsFileTime
GetProcAddress
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
HeapFree
GetProcessHeap
ole32
CreateBindCtx
CoUninitialize
CoTaskMemFree
CoInitializeEx
CoAllowSetForegroundWindow
user32
GetWindowRect
GetClipCursor
FindWindowExA
GetAsyncKeyState
MonitorFromPoint
SetForegroundWindow
ShowWindow
GetAncestor
msvcrt
memset
free
malloc
gdi32
CreateSolidBrush
Exports
Exports
XiChaanggeeProc
Sections
.text Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ