g:\Acro_root_at\bravo\public\libraries\windows\release\dynamic\BIBcrtstdll\BIB.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e8ba0aa2da54a167d0e59cf65b081efc_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
e8ba0aa2da54a167d0e59cf65b081efc_JaffaCakes118
-
Size
216KB
-
MD5
e8ba0aa2da54a167d0e59cf65b081efc
-
SHA1
7ce0a359d4401d06f34dbdbd21b3f2464d897ccc
-
SHA256
cc7a7826c474c87255c1df1dc73f64e386b50455dd95886381f212b0e4d51751
-
SHA512
65c4267861b1aefccba6dc5d5ceb44cff4de4cba61ac942d533e7574f94d337551ed7f5af3a37fe3c4371d246ca2a4b74be9539488550e605f37299942a054a5
-
SSDEEP
6144:vOp8HpzdQOStKnq49cw5DCQ0+0FNfR4zfJhL90:vOp8Hpz7q4CMv907fO9hLG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e8ba0aa2da54a167d0e59cf65b081efc_JaffaCakes118
Files
-
e8ba0aa2da54a167d0e59cf65b081efc_JaffaCakes118.dll windows:4 windows x86 arch:x86
4104f39762099d6928c8f8e15da57503
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
QueryPerformanceCounter
GetSystemTimeAsFileTime
CloseHandle
CreateThread
SetCurrentDirectoryA
GetCurrentDirectoryA
GetCurrentThreadId
GetTickCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentProcessId
msvcr80
malloc
free
fseek
ftell
feof
ferror
fread
fflush
fclose
fwrite
fopen
__RTDynamicCast
_encode_pointer
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_purecall
??3@YAXPAX@Z
memset
strlen
memcpy
qsort
log
strcmp
_CxxThrowException
__CxxFrameHandler3
_unlock
Exports
Exports
BIBGetGetProcAddress
BIBGetVersion
BIBInitialize
BIBInitialize2
BIBInitialize3
BIBInitialize4
BIBLockSmithAssertNoLocksImpl
BIBLockSmithDeleteImpl
BIBLockSmithLockImpl
BIBLockSmithUnlockImpl
BIBTerminate
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 119KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE