C:\f\save\bin\server\master\server\windows\release\CoreRT.pdb
Static task
static1
Behavioral task
behavioral1
Sample
766c88a0bd79f2c1f1c5931a15d93e8c_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
766c88a0bd79f2c1f1c5931a15d93e8c_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
766c88a0bd79f2c1f1c5931a15d93e8c_JaffaCakes118
-
Size
499KB
-
MD5
766c88a0bd79f2c1f1c5931a15d93e8c
-
SHA1
4640abc0b9eb2fe602eefc237931a8f0ea0b13db
-
SHA256
b66a017f772f6d4f82b9f045c63c01b819acfaee6c61155572c970cc7b8dd949
-
SHA512
6e926d6a7c74087878cf255373263c677d3241b98a8ed5388a329299349c3381c0fa4e028e62caab011174ca6907faa02d4195a44c272ba312e2e5b30eee75ba
-
SSDEEP
12288:62WBm1RgDMq+9qJ/KWnRST70qWv+PHPDjIkAD:62QCNq+cJ/KWRSv0lGPlAD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 766c88a0bd79f2c1f1c5931a15d93e8c_JaffaCakes118
Files
-
766c88a0bd79f2c1f1c5931a15d93e8c_JaffaCakes118.dll windows:6 windows x64 arch:x64
c5758eb0e7ba8f3e41d55126c7eb8fbe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetCommandLineW
IsDebuggerPresent
GetLastError
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
GetStdHandle
SwitchToThread
GetConsoleMode
SetConsoleMode
SetConsoleCP
SetConsoleOutputCP
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
InitializeSListHead
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
RtlCaptureContext
GetModuleFileNameW
VirtualProtect
OpenThread
GetCurrentThread
CloseHandle
GetFullPathNameW
DisableThreadLibraryCalls
user32
FindWindowW
MessageBoxA
msvcp140
?_Xbad_function_call@std@@YAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
_Thrd_detach
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_broadcast
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_XGetLastError@std@@YAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Syserror_map@std@@YAPEBDH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Tolower
_Toupper
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0codecvt_base@std@@QEAA@_K@Z
??1codecvt_base@std@@UEAA@XZ
??0ctype_base@std@@QEAA@_K@Z
??1ctype_base@std@@UEAA@XZ
?clear@ios_base@std@@QEAAXH_N@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??1ios_base@std@@UEAA@XZ
??0ios_base@std@@IEAA@XZ
?_Init@ios_base@std@@IEAAXXZ
?do_encoding@codecvt_base@std@@MEBAHXZ
?do_max_length@codecvt_base@std@@MEBAHXZ
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
vcruntime140
__std_type_info_destroy_list
__current_exception_context
memset
_purecall
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__current_exception
memcmp
memcpy
memmove
__CxxFrameHandler3
wcsstr
wcsrchr
strstr
__std_type_info_compare
__std_type_info_name
__RTDynamicCast
memchr
__C_specific_handler
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
terminate
_crt_atexit
_cexit
_errno
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_beginthreadex
api-ms-win-crt-heap-l1-1-0
realloc
malloc
_callnewh
free
api-ms-win-crt-convert-l1-1-0
strtoull
atoi
api-ms-win-crt-math-l1-1-0
_dsign
_dclass
_ldclass
ceilf
api-ms-win-crt-stdio-l1-1-0
_wfopen
fread
fseek
ftell
__stdio_common_vsprintf
setvbuf
fclose
__stdio_common_vfprintf
__stdio_common_vsnprintf_s
__acrt_iob_func
__stdio_common_vswprintf
api-ms-win-crt-filesystem-l1-1-0
_wunlink
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-string-l1-1-0
isspace
isprint
tolower
_stricmp
Exports
Exports
??0?$fwSingleton@VComponentLoader@@@@IEAA@XZ
??0ComponentData@@QEAA@XZ
??0ComponentId@@QEAA@$$QEAV0@@Z
??0ComponentId@@QEAA@AEBV0@@Z
??0ComponentId@@QEAA@XZ
??0ComponentLoader@@QEAA@XZ
??1?$fwSingleton@VComponentLoader@@@@IEAA@XZ
??1ComponentData@@UEAA@XZ
??1ComponentId@@QEAA@XZ
??1ComponentLoader@@QEAA@XZ
??4?$fwSingleton@VComponentLoader@@@@QEAAAEAV0@AEBV0@@Z
??4ComponentId@@QEAAAEAV0@$$QEAV0@@Z
??4ComponentId@@QEAAAEAV0@AEBV0@@Z
??4ComponentLoader@@QEAAAEAV0@$$QEAV0@@Z
??4ComponentLoader@@QEAAAEAV0@AEBV0@@Z
??_7ComponentData@@6B@
?AddComponent@ComponentLoader@@AEAAXV?$fwRefContainer@VComponentData@@@@@Z
?AddDependency@ComponentData@@QEAAXAEBV?$fwRefContainer@VComponentData@@@@@Z
?CompareVersion@ComponentId@@QEBAHAEBV1@@Z
?CreateInstance@ComponentData@@QEAA?AV?$fwRefContainer@VComponent@@@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?CreateManualInstance@ComponentData@@QEAA?AV?$fwRefContainer@VComponent@@@@XZ
?DoGameLoad@ComponentLoader@@QEAAXPEAX@Z
?EnsureInstance@?$fwSingleton@VComponentLoader@@@@CAXXZ
?ForAllComponents@ComponentLoader@@QEAAXAEBV?$function@$$A6AXV?$fwRefContainer@VComponentData@@@@@Z@std@@@Z
?GetCategory@ComponentId@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetCategory@ComponentId@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_K@Z
?GetDependencyDataList@ComponentData@@QEBAAEBV?$vector@V?$fwRefContainer@VComponentData@@@@V?$allocator@V?$fwRefContainer@VComponentData@@@@@std@@@std@@XZ
?GetHooksDll@@YAPEAVIGameSpecToHooks@@XZ
?GetInstance@?$fwSingleton@VComponentLoader@@@@SAPEAVComponentLoader@@XZ
?GetInstances@ComponentData@@QEBAAEBV?$vector@V?$fwRefContainer@VComponent@@@@V?$allocator@V?$fwRefContainer@VComponent@@@@@std@@@std@@XZ
?GetKnownComponents@ComponentLoader@@QEAAAEAV?$unordered_map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$fwRefContainer@VComponentData@@@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$fwRefContainer@VComponentData@@@@@std@@@2@@std@@XZ
?GetString@ComponentId@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetSubCategory@ComponentId@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetVersions@ComponentId@@QEBAPEBHXZ
?Initialize@ComponentLoader@@QEAAXXZ
?IsLoaded@ComponentData@@QEBA_NXZ
?IsMatchedBy@ComponentId@@QEBA_NAEBV1@@Z
?Load@ComponentData@@QEAAXXZ
?LoadComponent@ComponentLoader@@QEAA?AV?$fwRefContainer@VComponentData@@@@PEBD@Z
?Parse@ComponentId@@SA?AV1@PEBD@Z
?SetHooksDll@@YAXPEAVIGameSpecToHooks@@@Z
?SetLoaded@ComponentData@@QEAAX_N@Z
?m_instance@?$fwSingleton@VComponentLoader@@@@0PEAVComponentLoader@@EA
CoreAddPrintListener
CoreFxCreateObjectInstance
CoreFxFindFirstImpl
CoreFxFindImplClose
CoreFxFindNextImpl
CoreGetComponentRegistry
CoreGetGlobalInstanceRegistry
CoreIsDebuggerPresent
CoreSetDebuggerPresent
CoreSetPrintFunction
CoreTrace
CreateContext
DPrintf
GetDefaultContext
PrintError
PrintWarning
Printf
SetConsoleWriter
ToolMode_Init
ToolMode_LaunchGame
ToolMode_RunPostLaunchRoutine
ToolMode_SetGameFunction
ToolMode_SetPostLaunchRoutine
seCreateContext
seGetCurrentContext
Sections
.text Size: 345KB - Virtual size: 345KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 107KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ