Z:\code\work\safedog\msvc2013\SafedogServer\Windows\trunk\Version\ServerSln\Release_Unicode\Symbols\SafeDogDirDefend.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8e338cefdf1a9f0ce06fa999c005eaab_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8e338cefdf1a9f0ce06fa999c005eaab_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
8e338cefdf1a9f0ce06fa999c005eaab_JaffaCakes118
-
Size
1.6MB
-
MD5
8e338cefdf1a9f0ce06fa999c005eaab
-
SHA1
c500b67e242939bb2243606c4f1010c996248276
-
SHA256
6d063ac006745585d694bb2f67f6b6f55a08fceeedf3e9057cd62903a6a232cb
-
SHA512
ea8861de486c9bfe698bb9aa27e49160a7c56b13b59ab8d958bf0023ba0b7c265595b990394ef1fc3c52ac9e1fb743f05cc0c6999ea92a30741b533ca8e90858
-
SSDEEP
49152:/Q24UQuQVL2aLQ78fzAF4K7yKODaE2CeT9:/Q24UQuQVL2MI8fzK4eJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e338cefdf1a9f0ce06fa999c005eaab_JaffaCakes118
Files
-
8e338cefdf1a9f0ce06fa999c005eaab_JaffaCakes118.dll windows:5 windows x86 arch:x86
50ef11e494545a8c70242d0bfff61134
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
log4cplusu
?getInstance@Logger@log4cplus@@SA?AV12@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?macro_forced_log@detail@log4cplus@@YAXABVLogger@2@HABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PBDH2@Z
??1Logger@log4cplus@@UAE@XZ
?getRoot@Logger@log4cplus@@SA?AV12@XZ
?forcedLog@Logger@log4cplus@@QBEXHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PBDH1@Z
?get_macro_body_oss@detail@log4cplus@@YAAAV?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?isEnabledFor@Logger@log4cplus@@QBE_NH@Z
??0Logger@log4cplus@@QAE@$$QAV01@@Z
kernel32
TlsFree
GetCurrentThreadId
GetFileSize
GetModuleFileNameW
WaitForMultipleObjects
InterlockedDecrement
InterlockedIncrement
WaitForSingleObject
GetLogicalDriveStringsW
GetComputerNameW
FlushFileBuffers
WriteFile
SetFilePointer
TlsAlloc
QueueUserWorkItem
GetSystemInfo
CreateFileMappingW
InterlockedExchangeAdd
FindClose
GetLogicalDriveStringsA
InterlockedExchange
CreateFileA
GetDriveTypeW
GetSystemTime
GetModuleHandleA
Sleep
SystemTimeToFileTime
GetSystemTimeAsFileTime
WaitForMultipleObjectsEx
GetFileAttributesExW
CreateThread
CreateEventW
ExpandEnvironmentStringsW
ResumeThread
LocalFree
GetWindowsDirectoryW
OutputDebugStringA
LocalAlloc
GetProcAddress
SetLastError
CreateFileW
TerminateProcess
GetTickCount
LoadLibraryW
GetModuleHandleW
SearchPathW
ExitProcess
LeaveCriticalSection
GetLastError
EnterCriticalSection
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
DeleteCriticalSection
GetDriveTypeA
SleepEx
CloseHandle
GetVersion
WaitForSingleObjectEx
ReleaseSemaphore
DuplicateHandle
CreateEventA
GetCurrentProcess
InterlockedCompareExchange
UnmapViewOfFile
MapViewOfFile
OutputDebugStringW
FindFirstFileW
lstrcmpA
lstrcpyW
FreeLibrary
LoadLibraryA
GetProcessHeap
HeapAlloc
HeapFree
GetFileAttributesW
GetModuleFileNameA
FindNextFileW
DeleteFileW
WideCharToMultiByte
MultiByteToWideChar
ReadFile
GetWindowsDirectoryA
InitializeCriticalSectionAndSpinCount
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
DecodePointer
lstrlenW
QueryDosDeviceW
lstrcmpiW
GetVersionExW
GetFullPathNameW
GetFullPathNameA
SetEndOfFile
QueryPerformanceCounter
UnlockFile
LockFile
UnlockFileEx
FormatMessageA
FormatMessageW
GetFileAttributesA
GetTempPathW
LockFileEx
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetTempPathA
AreFileApisANSI
DeleteFileA
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
OpenEventA
ResetEvent
SetWaitableTimer
TlsGetValue
TlsSetValue
GetCurrentProcessId
CreateWaitableTimerA
IsValidCodePage
IsDBCSLeadByteEx
CreateSemaphoreA
SetEvent
InitializeCriticalSection
user32
IsCharAlphaW
LoadStringA
CharNextW
CharLowerW
advapi32
LookupAccountNameW
ConvertSidToStringSidA
RegQueryValueExW
RegOpenKeyW
RegQueryInfoKeyW
IsValidSid
RegEnumKeyExW
RegOpenKeyExW
QueryServiceConfigW
OpenServiceW
RegOpenKeyExA
OpenSCManagerW
CloseServiceHandle
RegCloseKey
communicate
_SendMessageToClient@8
config7
?GetBoolByFile@config7@@YA_NPB_W00_N1@Z
?GetInt@config7@@YAHPB_W00H_N@Z
?GetBool@config7@@YA_NPB_W00_N1@Z
??0Config@config7@@QAE@PB_W_N@Z
??1Config@config7@@QAE@XZ
?GetIntByFile@Config@config7@@QAEHPB_W0H@Z
safedogfilemon
StopWatchDirectory
StartWatchDirectory
DestroyFileMonInstance
SetFileMonNotify
CreateFileMonInstance
antivirudll
?getRecoveryPathById@ScannerControl@@QAE_NPB_WPA_WI1I@Z
?scanSingleFile@ScannerControl@@QAE?AW4_VIRUS_TYPE@@PB_WPAVCRiskInfo@@W4_ENGINE_TYPE@@PAXPAK@Z
?GetFileTypeByName@ScannerControl@@QAEHPB_WKPAW4_FILE_TYPE@@@Z
?initRiskInfo@ScannerControl@@QAEPAVCRiskInfo@@XZ
?freeRiskInfo@ScannerControl@@QAEXAAPAVCRiskInfo@@@Z
?isTrust@ScannerControl@@QAE_NPB_W@Z
?isPEFile@ScannerControl@@QAE_NPB_W@Z
?isTrustSign@ScannerControl@@QAE_NPB_W@Z
?RefreshTrustFile@ScannerControl@@QAEXXZ
?ScannerInstance@QScanItemInterface@@SAPAVScannerControl@@XZ
?repairSingleFile@ScannerControl@@QAE_NPB_W@Z
?deleteSingleFile@ScannerControl@@QAE_NPB_W@Z
?recoverySingleFileById@ScannerControl@@QAE_NPB_W0@Z
?isolateSingleFile@ScannerControl@@QAE_NPB_W@Z
?StopScanner@ScannerControl@@QAE_NXZ
?InitScanner_RT@ScannerControl@@QAEXXZ
?StopConfigMonitor@ScannerControl@@QAEHXZ
safedogserverdll
GetAccountSid
DoCheck
IsValidUser
msvcp120
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?classic@locale@std@@SAABV12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_BADOFF@std@@3_JB
?setf@ios_base@std@@QAEHHH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?uncaught_exception@std@@YA_NXZ
??0id@locale@std@@QAE@I@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
msvcr120
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_except_handler4_common
__clean_type_info_names_internal
_fsopen
isalnum
isspace
isalpha
_vsnprintf_s
sscanf_s
fprintf
strerror
??8type_info@@QBE_NABV0@@Z
memset
memcpy
__CxxFrameHandler3
_calloc_crt
_unlock
_lock
strncmp
_beginthreadex
wcstok
wcsncmp
_CxxThrowException
_wcslwr
_wcsnicmp
fread_s
??0exception@std@@QAE@XZ
atoi
realloc
fseek
ftell
fread
sprintf
wcsrchr
_errno
_wmkdir
_vscwprintf
_wfopen_s
fclose
wcscpy_s
_vsnwprintf_s
wcscat_s
strrchr
fwrite
wcsstr
_wstat64i32
_localtime64_s
wprintf
tolower
sprintf_s
towlower
_wcsdup
_vsnprintf
_time32
_vsnwprintf
malloc
free
swprintf_s
strchr
_gmtime64
_time64
_stricmp
wcsncpy_s
memchr
??_V@YAXPAX@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
_wcsicmp
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
memmove
_except1
__RTDynamicCast
memcmp
__dllonexit
ws2_32
WSAStartup
WSACleanup
ntohs
crypt32
CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CryptDecodeObject
CryptMsgClose
shlwapi
PathCommonPrefixA
PathGetArgsW
PathFindFileNameW
PathIsDirectoryW
PathAppendW
PathCommonPrefixW
PathRemoveFileSpecW
PathFindFileNameA
StrStrIW
PathFileExistsW
PathRemoveFileSpecA
PathFileExistsA
netapi32
NetUserEnum
NetApiBufferFree
activeds
ord3
fltlib
FilterConnectCommunicationPort
FilterClose
FilterGetMessage
FilterSendMessage
ole32
CoInitialize
CoUninitialize
oleaut32
VariantInit
SafeArrayUnaccessData
SysFreeString
SafeArrayGetUBound
SafeArrayAccessData
VariantClear
SafeArrayGetLBound
SysAllocString
log7
?WriteLogA@log7@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N1@Z
Exports
Exports
DirDefendLoop
DirDefendStop
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 242KB - Virtual size: 242KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ