c:\TenHead\StoryShop\BoneGentle\CityMolecule\camp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_90084242fd519b3a14db407c7ba6fb2db26be500c2ea4f466af8887cd472fb67.dll
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_90084242fd519b3a14db407c7ba6fb2db26be500c2ea4f466af8887cd472fb67
-
Size
626KB
-
MD5
f2da170689dde4b9a97c5305503cb3d9
-
SHA1
89fce97c5194e0498fe9c9cc19a4f7af208aa3f0
-
SHA256
90084242fd519b3a14db407c7ba6fb2db26be500c2ea4f466af8887cd472fb67
-
SHA512
061c4ab465a38ff6341f0886e607a15921ac922a17d54e3801c06ddf356cb2a38941e9c7499c59b9fa3332dc18a6576960cd7c050b599e083b8497f9e45c28fe
-
SSDEEP
12288:QxHGz7jrsxOZWGvw2uV+HZfyWdAHKHRuhtOJbIP5UsT9GdOxRCeg:jtWGvCV+5Qo8hPNT961eg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_90084242fd519b3a14db407c7ba6fb2db26be500c2ea4f466af8887cd472fb67
Files
-
JaffaCakes118_90084242fd519b3a14db407c7ba6fb2db26be500c2ea4f466af8887cd472fb67.dll windows:6 windows x86 arch:x86
b851db331f15ad36e816a5c958a671c3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
VirtualProtect
GetEnvironmentVariableW
Sleep
GetCurrentDirectoryW
CreateFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
WriteFile
OutputDebugStringW
CloseHandle
WaitForSingleObjectEx
CreateThread
HeapAlloc
HeapFree
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
SetStdHandle
SetFilePointerEx
DecodePointer
Exports
Exports
Bloodhard
Youngmachine
Sections
.text Size: 383KB - Virtual size: 382KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 233KB - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 383KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 724B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ