f:\Work\HP\CCRC_WORKING_FOLDER\dtss_view\dcsl_bp1\DTSS\hpqSSPrEn\Release\hpqSSPrEn.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7a60b50352bd4eba11823f14db8886c8_JaffaCakes118.dll
Resource
win7-20241023-en
General
-
Target
7a60b50352bd4eba11823f14db8886c8_JaffaCakes118
-
Size
396KB
-
MD5
7a60b50352bd4eba11823f14db8886c8
-
SHA1
91cee6e2f1344de38e11d862372ccf92f59709e5
-
SHA256
3bfb2eb0267863841b39e79b19dae6ed7dd51e41f75829a901a99b5a56557525
-
SHA512
e9befb4306dad456f2c71e01df96434fc98d5a3a5e63b33f9ee9159a4791061acef4a8ef2eefeb50350cf274883846e57d6dcee6810fecf3873e9b9c3ffa2fb9
-
SSDEEP
6144:qqLbBaUl9Q16a/Zc9YBnSE/d7hodP0KwK5PIaUtCrFTzS:5tlZa/ZcSBnSmd7hodP0JK5wbsTzS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7a60b50352bd4eba11823f14db8886c8_JaffaCakes118
Files
-
7a60b50352bd4eba11823f14db8886c8_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
0dd5f04427879889d2143f0f2f585279
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
winspool.drv
ord203
EnumPrintersW
kernel32
lstrcmpiW
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
GetLastError
GetModuleHandleW
SetThreadLocale
GetThreadLocale
LockResource
FindResourceExW
lstrcpyW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
CreateFileW
LoadLibraryExW
UnhandledExceptionFilter
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
ReadFile
GetLocaleInfoW
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
TerminateProcess
GetCurrentProcess
SetEndOfFile
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
VirtualFree
VirtualAlloc
HeapCreate
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
GetCPInfo
GetOEMCP
LCMapStringA
WideCharToMultiByte
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
CloseHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryA
GetStringTypeA
user32
CharNextW
UnregisterClassA
advapi32
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
ole32
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
oleaut32
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 128KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE