C:\Users\admin\Desktop\BrowserPlugins\npFreemake\Release\npFreemake.pdb
Static task
static1
Behavioral task
behavioral1
Sample
90f392a4cf798ee027ecc7287f0e36fa_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
90f392a4cf798ee027ecc7287f0e36fa_JaffaCakes118
-
Size
181KB
-
MD5
90f392a4cf798ee027ecc7287f0e36fa
-
SHA1
69b098ca1a1a95996da8548dea175fbbe77fd28a
-
SHA256
f13022015f6b147f4a6637dc764860f49eaa8f040b31656c281338f71b72a98a
-
SHA512
6c9b52d09e00f9f1ec833efbb14f95d2426bfcabfb24e482ff131da100d03718b99f298ed0129c9946f79128fef28de608f4e676bf22c0cc9f1708ceade3041a
-
SSDEEP
1536:61Pnv0wn+OHkJ9yhGdliDSA2PrGWESsBo2ZjPNxB3UB+1uw8bpkTWgTzMymmeCHO:wnuucdliWAQrxNccnbYntHJ3cp7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 90f392a4cf798ee027ecc7287f0e36fa_JaffaCakes118
Files
-
90f392a4cf798ee027ecc7287f0e36fa_JaffaCakes118.dll windows:5 windows x86 arch:x86
83b79c2d389df3c98888407e9712a43e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
CreateProcessW
MultiByteToWideChar
GetStringTypeW
GetCurrentThreadId
DecodePointer
GetCommandLineA
RaiseException
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
HeapAlloc
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
GetProcAddress
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
HeapSize
WriteFile
GetModuleFileNameW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LoadLibraryW
LCMapStringW
user32
wsprintfW
advapi32
RegQueryValueExW
RegOpenKeyExW
Exports
Exports
NP_GetEntryPoints
NP_Initialize
NP_Shutdown
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 125KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE