E:\WorkCode\svnInstallerVersion5\InstallerVersion5\bin\dll\HiJackDll.pdb
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_473d0eea52e4c9128926811065a55b60.dll
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_473d0eea52e4c9128926811065a55b60
-
Size
223KB
-
MD5
473d0eea52e4c9128926811065a55b60
-
SHA1
06c1db283660dd057bf846aa6cb444b74c25eb0f
-
SHA256
85091bfad769f95f9048f3b81845fc470c37adcd667a18b6226c47e91de7604a
-
SHA512
52e7f78330d42c768304c86664fb9fa7029517f7025334ac345b9116ec572938eba1cd882ee3955c94afc297e5da748cd4cddf49851a1cfa8596480860c5c08f
-
SSDEEP
3072:qmY2UXXqE+A6/Q2BBzrwj9o+vNNbbVweMh5R0MgTBqCxjdaK+3xPWzgjLwwEJo+j:YKEaXwj7BMhv0JBhjgK+pWBui+8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_473d0eea52e4c9128926811065a55b60
Files
-
JaffaCakes118_473d0eea52e4c9128926811065a55b60.dll windows:5 windows x86 arch:x86
f8a73973996d72f6f39b6532ccbe6d23
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
shlwapi
PathFileExistsA
PathAppendA
shell32
CommandLineToArgvW
user32
MessageBoxA
kernel32
WaitForSingleObject
ExitProcess
AddVectoredExceptionHandler
GetCommandLineW
LocalFree
CreateToolhelp32Snapshot
Process32First
CloseHandle
Process32Next
OpenProcess
GetCurrentProcessId
GetModuleFileNameA
GetCurrentProcess
MultiByteToWideChar
VirtualFree
VirtualAlloc
VirtualProtect
CreateFileA
GetFileSizeEx
ReadFile
GetModuleHandleA
LoadLibraryA
GetProcAddress
EncodePointer
DecodePointer
GetLastError
CreateThread
GetCurrentThreadId
ExitThread
LoadLibraryExW
HeapAlloc
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCommandLineA
RaiseException
RtlUnwind
InterlockedDecrement
GetModuleHandleExW
HeapSize
Sleep
GetStdHandle
WriteFile
GetModuleFileNameW
SetLastError
InterlockedIncrement
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcessHeap
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
GetFileType
DeleteCriticalSection
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
OutputDebugStringW
LoadLibraryW
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CreateFileW
Exports
Exports
GetCppModuleInterface
RunUpdate
StartAsFrameProcess
Sections
.text Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 115KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE