d:\NPS_VSS_ROOT\NPS2\bin\release\program files\NPSImageViewer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0849d17a4e35e2aaf8504804b440f729_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0849d17a4e35e2aaf8504804b440f729_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0849d17a4e35e2aaf8504804b440f729_JaffaCakes118
-
Size
360KB
-
MD5
0849d17a4e35e2aaf8504804b440f729
-
SHA1
89709ba7de344b17991df2f631cfdb62d2f0c76c
-
SHA256
c6f357f91477c89d690c5c32eb55296bbfd4f1435c34bb394a367f594869c59c
-
SHA512
36bdf0866ad2b4a78071ae3020ade65b2d493d31fba240c0aa11c22c35a95a62f79252fd3e7963434fee1bd1093d9c715aedad0bba4f558477d2ea5405427ba7
-
SSDEEP
6144:ECro51bYeLjTYcO7W04kYE9dO6u+7wLFGUxHP/EMQ:/e0CyYE9d37CFGQ/g
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0849d17a4e35e2aaf8504804b440f729_JaffaCakes118
Files
-
0849d17a4e35e2aaf8504804b440f729_JaffaCakes118.exe windows:4 windows x86 arch:x86
717b04df343874de237fd86ca9ffb150
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
npscommon5
?PostNcDestroy@CSkinWnd@@MAEXXZ
?LoadBitmapFromResource@CGdiPlusUtil@@QAEPAVBitmap@Gdiplus@@PAUHINSTANCE__@@PB_W1H@Z
?GetThisMessageMap@CSkinAppWnd@@KGPBUAFX_MSGMAP@@XZ
?GetRuntimeClass@CSkinAppWnd@@UBEPAUCRuntimeClass@@XZ
??1CGdiPlusUtil@@UAE@XZ
??0CGdiPlusUtil@@QAE@XZ
?OnPaint@CSkinWnd@@QAEXXZ
?SetTitleImage@CSkinAppWnd@@IAEXI@Z
??1CPngButton@@UAE@XZ
?SetImage@CPngButton@@QAEXIPAUHINSTANCE__@@@Z
?SetToolTipText@CPngButton@@QAEXPB_WH@Z
?OnCreate@CSkinAppWnd@@QAEHPAUtagCREATESTRUCTW@@@Z
?PreCreateWindow@CSkinAppWnd@@MAEHAAUtagCREATESTRUCTW@@@Z
?OnSize@CSkinWnd@@QAEXIHH@Z
??0CNPS2ImageInfoDlg@@QAE@PAVCWnd@@@Z
??1CNPS2ImageInfoDlg@@UAE@XZ
?SetFile@CNPS2ImageInfoDlg@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetFullScreen@CTitleWnd@@QAEXH@Z
?OnMinimize@CSkinWnd@@QAEXXZ
?DoModal@CNPS2ImageInfoDlg@@UAEHXZ
?OnRestore@CSkinWnd@@QAEXXZ
?OnWindowPosChanged@CSkinWnd@@QAEXPAUtagWINDOWPOS@@@Z
?ShowRestoreButton@CTitleWnd@@QAEXH@Z
?OnLButtonDown@CSkinWnd@@QAEXIVCPoint@@@Z
?SetTitle@CTitleWnd@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?OpenKey@CRegistry@@QAEHPAUHKEY__@@PB_W@Z
?CloseKey@CRegistry@@QAEXXZ
?GetValue@CRegistry@@QAEHPB_WAAK@Z
??0CSkinAppWnd@@QAE@XZ
?PreTranslateMessage@CSkinAppWnd@@UAEHPAUtagMSG@@@Z
?OnActivate@CSkinWnd@@QAEXIPAVCWnd@@H@Z
?OnWindowPosChanging@CSkinWnd@@QAEXPAUtagWINDOWPOS@@@Z
??1CSkinAppWnd@@UAE@XZ
?OnTimer@CSkinWnd@@QAEXI@Z
??1CRegistry@@QAE@XZ
?BeginDragDrop@CNPSDragTarget@@QAEXPAVCStringList@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAUHWND__@@@Z
??1CNPSDragTarget@@UAE@XZ
??0CNPSDragTarget@@QAE@XZ
?ResetBackImage@CPngButton@@QAEXXZ
?EnableWindow@CPngButton@@QAEHH@Z
??0CPngButton@@QAE@XZ
npsfunction5
?GetParentPath@CShareFunc@@SAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAV23@H@Z
?FindExtension@CShareFunc@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@ABV23@@Z
?IsRTLReading@CShareFunc@@SAHXZ
?GetDocumentPhotoPath@CShareFunc@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetSizeFromStr@CShareFunc@@SAX_KAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?WCtoMB@CShareFunc@@SAXABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAD@Z
?NPSUpdatePaste@CShareFunc@@SA_NPAUHWND__@@H@Z
?GetAppPath@CShareFunc@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?NPSPaste@CShareFunc@@SAJPAUHWND__@@PAVCStringList@@@Z
?NPSGetClipboardEffect@CShareFunc@@SAKXZ
?NPSCopy@CShareFunc@@SAJPAUHWND__@@PAVCStringList@@@Z
npsconverter
?Decode@CExtWbmp@@QAEHAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?MakeBitmapHandle@CPictureEx@@QAEHXZ
?GetBitmapHandle@CPictureEx@@QAEHIAAPAUHBITMAP__@@AAI@Z
?GetBitmapHandle@CPictureEx@@QAEHAAPAUHBITMAP__@@@Z
??0CPictureEx@@QAE@XZ
?Load@CPictureEx@@QAEHPB_W@Z
?UnLoad@CPictureEx@@QAEXXZ
?GetMessageMap@CPictureEx@@MBEPBUAFX_MSGMAP@@XZ
??1CPictureEx@@UAE@XZ
??0CImageConverter@@QAE@XZ
??1CImageConverter@@QAE@XZ
?IsValidGIF@CImageConverter@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
??0CExtWbmp@@QAE@XZ
??1CExtWbmp@@UAE@XZ
?GetFrameCount@CPictureEx@@QAEHXZ
dump
?RegisterCrashHandler@@YAHPB_W0@Z
npscomnctrl
?TrackPopupMenu@CNPSTransMenu@@QAEXIHHPAVCWnd@@PBUtagRECT@@H@Z
??0CNPSTransMenu@@QAE@XZ
??1CNPSTransMenu@@UAE@XZ
?LoadMenuW@CNPSTransMenu@@QAEHIPAUHINSTANCE__@@K@Z
?Ole2SysDate@NPSSystemDateTime@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@VCOleDateTime@3@H@Z
??0NPSSystemDateTime@@QAE@XZ
??1NPSSystemDateTime@@QAE@XZ
?Initialize@CWndShadow@@SA_NPAUHINSTANCE__@@@Z
NPSLOG
?InitNPSSkinManager@@YAXPB_W0@Z
?NPSMessageBox@@YAHPAUHWND__@@PB_W1I@Z
?SetThreadLocaleEx@@YAHK@Z
?GetMenuSize@CNPSTransMenu@@SA?AVCSize@@PAVCMenu@@@Z
mfc80u
ord1198
ord5373
ord5829
ord1058
ord4388
ord2086
ord1582
ord4234
ord3311
ord4074
ord1220
ord4026
ord4100
ord1472
ord1086
ord347
ord3104
ord4032
ord2239
ord4008
ord6272
ord3795
ord6274
ord5971
ord4320
ord2054
ord5579
ord3800
ord1007
ord764
ord1299
ord2697
ord4480
ord5067
ord1002
ord2696
ord3943
ord2638
ord1962
ord1899
ord3703
ord4238
ord3713
ord1393
ord1118
ord3103
ord3195
ord3712
ord3940
ord776
ord2527
ord1608
ord3990
ord2640
ord1611
ord288
ord2534
ord5911
ord5430
ord2856
ord6721
ord2167
ord4276
ord1154
ord2708
ord6002
ord386
ord4301
ord631
ord2829
ord1386
ord2271
ord1178
ord2725
ord5711
ord2279
ord2531
ord5196
ord1590
ord3925
ord826
ord1646
ord2250
ord1647
ord1955
ord5558
ord4119
ord1353
ord2742
ord4961
ord6086
ord2745
ord2461
ord3339
ord5524
ord2885
ord2277
ord6275
ord2569
ord3796
ord2898
ord6273
ord1476
ord998
ord1513
ord1431
ord2163
ord5083
ord2169
ord899
ord762
ord317
ord2399
ord1894
ord584
ord2381
ord774
ord1425
ord2379
ord1430
ord2397
ord313
ord2409
ord1946
ord1189
ord2386
ord4094
ord6061
ord4902
ord1182
ord2402
ord2085
ord2407
ord2390
ord2392
ord1079
ord283
ord1202
ord1176
ord2394
ord3238
ord2366
ord6282
ord2388
ord385
ord265
ord1172
ord2404
ord630
ord266
ord5316
ord2384
ord3050
ord1523
ord931
ord2365
ord927
ord1479
ord929
ord925
ord280
ord4347
ord920
ord6302
ord2012
ord282
ord5229
ord558
ord3051
ord5231
ord293
ord746
ord833
ord3249
ord5956
ord2297
ord1591
ord3032
ord4716
ord577
ord2311
ord6301
ord3397
ord444
ord557
ord677
ord6700
ord745
ord384
ord1274
ord629
ord284
ord380
ord2275
ord4179
ord5489
ord4255
ord6271
ord3204
ord2255
ord572
ord6058
ord760
ord3155
ord2521
ord5607
ord6056
ord5604
ord6050
ord4155
ord3678
ord6053
ord5884
ord6033
ord5723
ord5638
ord5643
ord5519
ord5584
ord5410
ord5397
ord5917
ord2889
ord5715
ord3174
ord1271
ord5171
ord5210
ord5096
ord5148
ord602
ord1270
ord330
ord589
ord5633
ord5609
ord5870
ord1959
ord501
ord1925
ord709
ord3590
ord567
ord758
ord3198
ord5727
ord4117
ord3995
ord4461
ord4463
ord4467
ord3677
ord1121
ord1049
ord4025
ord4028
ord566
ord757
ord578
ord1156
ord304
ord3327
ord3824
ord4475
ord2832
ord5562
ord5209
ord5226
ord4562
ord3942
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
msvcr80
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CxxFrameHandler3
memset
memcpy
_waccess
wcscpy_s
malloc
free
_localtime64_s
_time64
_wcsdup
_amsg_exit
__wgetmainargs
kernel32
GetThreadLocale
GetVersionExA
lstrcpyW
WinExec
GetLocaleInfoA
GetACP
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
GetProcAddress
LoadLibraryW
lstrlenW
GetVersionExW
GetModuleFileNameW
WideCharToMultiByte
MulDiv
user32
GetWindowRect
GetCursorPos
SetParent
KillTimer
EnableWindow
IsRectEmpty
LoadAcceleratorsW
InsertMenuW
SendMessageW
SetCapture
IntersectRect
GetParent
GetActiveWindow
SetRectEmpty
GetSystemMetrics
GetMonitorInfoW
GrayStringW
RemoveMenu
AppendMenuW
ModifyMenuW
CreateMenu
RegisterWindowMessageW
InvalidateRect
CreatePopupMenu
EnableMenuItem
CheckMenuItem
GetKeyState
CopyRect
TabbedTextOutW
MonitorFromRect
GetSubMenu
GetCapture
OffsetRect
PtInRect
DrawTextW
ReleaseCapture
LoadCursorW
SetCursor
PostMessageW
SetRect
SetTimer
SetWindowPos
GetClientRect
DrawTextExW
gdi32
PtVisible
GetViewportExtEx
RectVisible
DPtoLP
GetMapMode
GetWindowExtEx
GetObjectW
SetDCPenColor
CreateFontIndirectW
GetDeviceCaps
GetTextCharsetInfo
GetBkColor
ExtTextOutW
StretchBlt
CreateCompatibleDC
Escape
BitBlt
CreateCompatibleBitmap
LPtoDP
TextOutW
comctl32
InitCommonControlsEx
oleaut32
SystemTimeToVariantTime
VariantTimeToSystemTime
gdiplus
GdipDeleteGraphics
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipDisposeImage
GdipCreateBitmapFromFile
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipImageSelectActiveFrame
GdipSetInterpolationMode
GdipImageRotateFlip
GdipCreateHBITMAPFromBitmap
GdipImageGetFrameDimensionsCount
GdipDrawImageRectI
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectRectI
GdipSetImageAttributesWrapMode
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipCreateFromHDC
Sections
.text Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 256KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ada Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE