C:\Build\source\rpbrowserrecordplugin\rel32\nprndlchromebrowserrecordext.pdb
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_51c4aa3c2732a7ee5358f83358b811a5.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_51c4aa3c2732a7ee5358f83358b811a5
-
Size
210KB
-
MD5
51c4aa3c2732a7ee5358f83358b811a5
-
SHA1
9f0b55b1a06d69428bfc9f6fbf25823553c8bbb8
-
SHA256
461625556adca12d41a36efbe61634d2a7348dce976f4bc15cccd65c2a4332ad
-
SHA512
b41180e3034aa169cb3532a37dc17640f5083374db2f4a54f84a3086194bfa00f7a67ef775071e507a1119a5b4f78a700532ffa44ddd4fdaa90cff91ccb24f10
-
SSDEEP
3072:eMYuwKhHgaG6I4ZisOZGh7psQY8MtsXsOndJdx7yT3VMZ2cA2k48ZUV7iC+BMg:eMYuwKpgaG6EZGBpvsOndJdgcD8OV7iD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_51c4aa3c2732a7ee5358f83358b811a5
Files
-
JaffaCakes118_51c4aa3c2732a7ee5358f83358b811a5.dll windows:5 windows x86 arch:x86
0952399aca346b9e8a03e29fe5a98fff
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetCurrentProcessId
ResetEvent
SetEvent
DisconnectNamedPipe
FlushFileBuffers
WaitForMultipleObjects
ReadFile
ResumeThread
CreateThread
GetOverlappedResult
WaitForMultipleObjectsEx
ConnectNamedPipe
CreateNamedPipeA
WaitNamedPipeA
SetLastError
CreateFileA
CreateEventA
CreateMutexA
OpenMutexA
OutputDebugStringA
GetTempPathA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
GetEnvironmentVariableA
WaitForSingleObject
IsProcessorFeaturePresent
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CloseHandle
WriteFile
CreateProcessA
EncodePointer
DecodePointer
lstrlenA
MultiByteToWideChar
GetModuleHandleA
LoadLibraryW
GetProcAddress
FreeLibrary
lstrlenW
WideCharToMultiByte
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetLastError
LocalFree
RaiseException
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
user32
SetParent
CreateWindowExW
RegisterClassExW
SetWindowLongA
GetWindowLongA
DefWindowProcA
FindWindowW
SendMessageTimeoutA
DestroyWindow
UnregisterClassW
SetWindowsHookExA
UnhookWindowsHookEx
GetSystemMetrics
advapi32
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
msvcr100
__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
printf
fopen
fprintf
fclose
vswprintf_s
_vscwprintf
iswprint
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
_CIpow
towlower
iswspace
iswdigit
_snwprintf
??0exception@std@@QAE@ABQBDH@Z
_ismbblead
strrchr
memmove
_vsnprintf
realloc
malloc
wcsnlen
memcpy
??_U@YAPAXI@Z
??_V@YAXPAX@Z
__CxxFrameHandler3
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_mbscmp
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
wcstol
??2@YAPAXI@Z
??8type_info@@QBE_NABV0@@Z
_recalloc
calloc
free
memmove_s
memcpy_s
_wcsicmp
wmemcpy_s
_purecall
??3@YAXPAX@Z
memset
__CppXcptFilter
msvcp100
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@
??_7ios_base@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Incref@facet@locale@std@@QAEXXZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Lockit@std@@QAE@XZ
?_Id_cnt@id@locale@std@@0HA
?id@?$ctype@_W@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_BADOFF@std@@3_JB
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
shell32
SHCreateDirectoryExW
SHGetFolderPathW
shlwapi
PathAppendW
Exports
Exports
NP_GetEntryPoints
NP_Initialize
NP_Shutdown
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 63KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE