c:\buildviews\howfw_14.2\howfw0625\output\wifi_win_w7\ipan\dualserver\win32\release\PanDhcpDns.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ef408e9c1dda6580799df37d8ec8261e_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
ef408e9c1dda6580799df37d8ec8261e_JaffaCakes118
-
Size
290KB
-
MD5
ef408e9c1dda6580799df37d8ec8261e
-
SHA1
2ca43ea89bf458bb8362099c35a5340e92714987
-
SHA256
dbbc409dc7909de6b28bfe5d93caedfe0436575a4a250ce447e2e77a40c38316
-
SHA512
430f46025d5cd97705d8047e5158ea6964d5b6e53c6c71d4eb9ba80673c527ca7b5770e57c1e51a555c9b357ac4424e829e8ed0677779de12a6a8351a0583dad
-
SSDEEP
6144:Z2+XDXR0ufiiT+Lns4qm/1D3GHTe9NY5Yo:Zz7R0Jv1D2Hi+Yo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef408e9c1dda6580799df37d8ec8261e_JaffaCakes118
Files
-
ef408e9c1dda6580799df37d8ec8261e_JaffaCakes118.exe windows:4 windows x86 arch:x86
8ad42ed14e1fe5377d788b221ca53144
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
select
listen
shutdown
recvfrom
ntohs
closesocket
connect
ntohl
WSASocketA
setsockopt
socket
send
inet_addr
htons
htonl
accept
sendto
__WSAFDIsSet
inet_ntoa
WSAIoctl
WSACleanup
recv
bind
WSAStartup
WSAGetLastError
iphlpapi
GetNetworkParams
GetAdaptersInfo
shlwapi
PathAppendA
advapi32
StartServiceCtrlDispatcherA
ControlService
SetServiceStatus
RegisterServiceCtrlHandlerA
RegCloseKey
OpenServiceA
DeleteService
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegEnumKeyExA
CloseServiceHandle
RegOpenKeyExA
OpenSCManagerA
QueryServiceStatus
CreateServiceA
user32
LoadStringA
ole32
CoUninitialize
CLSIDFromString
CoInitializeEx
CoCreateInstance
OleRun
CLSIDFromProgID
oleaut32
SysFreeString
SysAllocString
GetErrorInfo
kernel32
CreateFileA
GetConsoleCP
FlushFileBuffers
GetLocaleInfoA
GetConsoleMode
SetFilePointer
SetStdHandle
GetStringTypeW
GetStringTypeA
ReadFile
SetEndOfFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapSize
LoadLibraryA
ResumeThread
LCMapStringW
LCMapStringA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
WriteFile
GetStartupInfoA
GetFileType
GetTimeFormatA
SetEvent
GlobalAlloc
Sleep
GetLastError
OutputDebugStringA
InterlockedDecrement
MultiByteToWideChar
GlobalFree
lstrcmpiA
GetModuleFileNameA
GetVersionExA
WaitForSingleObject
lstrlenA
GetTempPathA
GetDateFormatA
GetLocalTime
GetModuleHandleA
CreateEventA
CloseHandle
HeapFree
GetProcessHeap
ExitThread
GetStdHandle
CreateThread
GetSystemTimeAsFileTime
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
ExitProcess
GetCommandLineA
RaiseException
RtlUnwind
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
GetTimeZoneInformation
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
SetHandleCount
InitializeCriticalSection
Sections
.text Size: 172KB - Virtual size: 171KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE