F:\work\battle_v2\client\Release\HookGame.pdb
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_494d69e401710d73f9fad92ad9b63ba0.dll
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_494d69e401710d73f9fad92ad9b63ba0
-
Size
178KB
-
MD5
494d69e401710d73f9fad92ad9b63ba0
-
SHA1
38c906d88174bc3f557fb983ac4ae362dbca7d0f
-
SHA256
4e1054cd19da53cc44cb335cc09099d9d8e834aebb370bb87d19359ad4d62ec5
-
SHA512
f3c90adfbfd65feab88568a484dd548e1c472271b2659b49dabbef77b86759c02c020ad2bc17d3ce4686e06015973d76e25f596017aeaf2cb7c8b43b68282bd1
-
SSDEEP
3072:s3tpFztj7IKML0E46mIWhixlDsx5nb+P2XY/43n9M9sbHNl:0tprjsKEQwSjIAhl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_494d69e401710d73f9fad92ad9b63ba0
Files
-
JaffaCakes118_494d69e401710d73f9fad92ad9b63ba0.dll windows:5 windows x86 arch:x86
bc91d62dcf97ea8c0d47801b09e924b6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CreateEventW
PostQueuedCompletionStatus
CloseHandle
WaitForSingleObject
SetLastError
GetQueuedCompletionStatus
SetEvent
GetTickCount
lstrcmpA
IsBadWritePtr
Sleep
GetModuleFileNameA
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateFileMappingW
MapViewOfFile
CreateIoCompletionPort
LoadLibraryA
GetProcAddress
GetModuleHandleW
VirtualProtect
GetCurrentProcess
lstrlenW
LoadLibraryW
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetLastError
CreateThread
ResumeThread
GetModuleHandleA
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetModuleFileNameW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
ExitProcess
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
VirtualAlloc
InitializeCriticalSectionAndSpinCount
CreateFileA
SetFilePointer
MultiByteToWideChar
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
user32
wsprintfA
wsprintfW
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ws2_32
WSASetLastError
WSAGetLastError
inet_addr
WSASetEvent
gethostname
closesocket
WSASocketW
WSAIoctl
WSAStartup
htons
gethostbyname
getsockopt
iphlpapi
GetAdaptersAddresses
Sections
.text Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rmnet Size: 56KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE