c:\sheetFell\melodyRound\ObjectHad\howfly\Plural.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cecc7c45b526be846e68a05775a05ec1809342b0dc225fd4335ae252e07cd200.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_09df7dedf59f5f800e844c418400167f34d3d964db93144788c1ca206826f5e7
-
Size
131KB
-
MD5
8a518b6af88f7a8e48b5a9a568ad68fb
-
SHA1
0e4287ff30342fbb3ab2adcb7484a4d15b13bc4d
-
SHA256
09df7dedf59f5f800e844c418400167f34d3d964db93144788c1ca206826f5e7
-
SHA512
65d849f5814636df163809ce54c4b1905f36e6ce8983e08870b711a17bcec04a54ac392ff26d388d28b60dd07d1f74d51e93d66c95cd84ebe024aa8899de6a71
-
SSDEEP
3072:cQlG4VYu8hfo/YPYbI1CxDNrnDASR1ZcIRqrpcWCJE:ci+R3P71YhrD/R1ZLApX4E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cecc7c45b526be846e68a05775a05ec1809342b0dc225fd4335ae252e07cd200
Files
-
JaffaCakes118_09df7dedf59f5f800e844c418400167f34d3d964db93144788c1ca206826f5e7.zip
Password: infected
-
cecc7c45b526be846e68a05775a05ec1809342b0dc225fd4335ae252e07cd200.dll regsvr32 windows:4 windows x86 arch:x86
7db1dc297d40997218b7b7fb0b57245c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
VirtualProtect
Sleep
GetWindowsDirectoryA
GetTempPathA
RaiseException
RtlUnwind
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
WriteFile
HeapSize
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
InitializeCriticalSection
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
Exports
Exports
DllRegisterServer
Sections
.text Size: 148KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ