recuehva.pdb
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_43729648b032f8b8bf315299d8894237.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_43729648b032f8b8bf315299d8894237.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_43729648b032f8b8bf315299d8894237
-
Size
88KB
-
MD5
43729648b032f8b8bf315299d8894237
-
SHA1
c6f8261b0e6a0542eff89daf8fa04d51d6e5cddb
-
SHA256
b9fd0c7b637f61a56c22c9a60fcbbae33c41558b45e0b44e6d0dd21bd194fab3
-
SHA512
5f8ae8006393bcceef28deb670d3df7734572af65a92e6a2f300ba51b3d6b59f981f7bf47eef7420675c89f845745db13598d090e5b443ebb8e6b799c763fc49
-
SSDEEP
1536:C1hQQOyDyIw8xY0hzyZ6QdIg6Wncl6yno8PcX0BryNZHOVS+vDDDZP04L8:2AXSzvQdIghnCAX/O0+7ps4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_43729648b032f8b8bf315299d8894237
Files
-
JaffaCakes118_43729648b032f8b8bf315299d8894237.dll windows:4 windows x86 arch:x86
b1a549eec284461ee9dc78964a7ea8ae
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CreateHardLinkW
GetVersionExW
GetFileSizeEx
GetTimeFormatW
GetDateFormatW
GetLastError
FormatMessageW
GetCurrentProcess
GetCurrentThread
GetFullPathNameW
GetDiskFreeSpaceExW
GetSystemInfo
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
SetFilePointerEx
SetEndOfFile
DeleteFileW
GetModuleHandleW
GetProcAddress
CreateFileW
DeviceIoControl
CloseHandle
LocalFree
GetModuleHandleA
ole32
StringFromIID
CoTaskMemFree
user32
GetWindowLongA
FindWindowA
advapi32
OpenThreadToken
AdjustTokenPrivileges
OpenEventLogW
ReadEventLogW
LookupAccountSidW
CloseEventLog
LookupAccountNameW
RevertToSelf
CheckTokenMembership
AllocateAndInitializeSid
ImpersonateSelf
LookupPrivilegeValueW
OpenProcessToken
msvcrt
wcscpy
isalpha
calloc
printf
wprintf
towupper
swprintf
toupper
wcscat
wcsncat
wcslen
free
isdigit
malloc
Exports
Exports
mdqi
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 572B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ