C:\BUILD_~1\jdk6_15\control\build\WINDOW~1\tmp\deploy\common\bin\deploy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
097cb5adb46babdeec90c8372859761a_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
097cb5adb46babdeec90c8372859761a_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
097cb5adb46babdeec90c8372859761a_JaffaCakes118
-
Size
236KB
-
MD5
097cb5adb46babdeec90c8372859761a
-
SHA1
a4790baef4d74f687f74a17a69cde55c8cfd86b2
-
SHA256
722c67859656530384c403cbec66681acfc0f0efe57ec56d4ab37d59abab9069
-
SHA512
06baeb10b650f960af13657a3ef0ae98a2088e022d494887a26211ed5b3f96be6e7c0a465018bb302772203f7c0646e88854de2f997dc05d4d15ea8973bccb38
-
SSDEEP
3072:P0BxcCDosssPU6uofCWoq5Xc1HjE+O3RVnPROXKsz6gS/ujWLtjPahFnLjEdApkN:c8cPUoDID03nZb86ZuojaDEd5Gs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 097cb5adb46babdeec90c8372859761a_JaffaCakes118
Files
-
097cb5adb46babdeec90c8372859761a_JaffaCakes118.dll windows:4 windows x86 arch:x86
f4410ddd712e9671bce91731f1b59eda
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
crypt32
CryptAcquireCertificatePrivateKey
CertGetPublicKeyLength
CertFreeCertificateChain
CertGetEnhancedKeyUsage
CertOpenSystemStoreA
CertEnumCertificatesInStore
CertCloseStore
CertGetCertificateChain
kernel32
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
FormatMessageA
ExpandEnvironmentStringsA
SystemTimeToFileTime
GetSystemTime
GetCurrentThreadId
QueryPerformanceCounter
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SizeofResource
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
RaiseException
GetProcAddress
LoadLibraryA
GetModuleHandleA
lstrlenA
FreeLibrary
LocalFree
WideCharToMultiByte
GetModuleFileNameA
CloseHandle
GetLastError
lstrlenW
GetWindowsDirectoryA
GetSystemDirectoryA
GetSystemWindowsDirectoryA
GetCurrentProcessId
GetTempPathA
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
GetTickCount
DeleteCriticalSection
GetCurrentProcess
GetSystemTimeAsFileTime
user32
GetWindowThreadProcessId
GetForegroundWindow
wsprintfA
CharNextA
MessageBoxA
wsprintfW
ExitWindowsEx
DefWindowProcA
RegisterClassA
CreateWindowExA
GetWindowLongA
SetWindowLongA
TranslateMessage
DispatchMessageA
GetMessageA
ReleaseDC
GetDC
GetDesktopWindow
CreateIconIndirect
DestroyIcon
CreatePopupMenu
AppendMenuW
ModifyMenuW
SetMenuDefaultItem
PostMessageA
TrackPopupMenu
SetForegroundWindow
GetCursorPos
FindWindowExA
GetWindowRect
PostQuitMessage
ShowWindow
gdi32
GetStockObject
CreateDIBitmap
CreateDIBSection
CreateBitmap
DeleteObject
advapi32
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegEnumValueA
RegFlushKey
RegOpenKeyA
RegCreateKeyA
CryptCreateHash
CryptSetHashParam
CryptSignHashA
CryptDestroyHash
CryptDestroyKey
CryptGetUserKey
CryptSetKeyParam
CryptGetKeyParam
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryInfoKeyA
GetUserNameW
shell32
FindExecutableA
ShellExecuteA
Shell_NotifyIconW
ShellExecuteExA
ole32
CoInitialize
CLSIDFromProgID
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
VarUI4FromStr
VariantClear
VariantInit
wininet
InternetCloseHandle
InternetGetCookieA
InternetGoOnline
InternetSetOptionA
InternetSetCookieA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetQueryOptionA
urlmon
FindMimeFromData
msvcr71
__dllonexit
??1type_info@@UAE@XZ
wcsncpy
_local_unwind2
strstr
realloc
??_U@YAPAXI@Z
_resetstkoflw
_dup
_dup2
_lseek
_tempnam
calloc
strrchr
strtok
fopen
fputs
fclose
remove
malloc
??_V@YAXPAX@Z
free
wcscmp
wcslen
_except_handler3
strncpy
??2@YAPAXI@Z
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
_purecall
_initterm
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
_strdup
_stricmp
_close
_onexit
__security_error_handler
memset
_open
_fstat
_read
Exports
Exports
??0BasicPerfHelper@@QAE@ABV0@@Z
??0BasicPerfHelper@@QAE@ABVSystemTime@@AAVNativeLock@@@Z
??0BasicPerfStore@@QAE@ABV0@@Z
??0BasicPerfStore@@QAE@ABVSystemTime@@AAVNativeLock@@@Z
??0DeployPerf@@QAE@ABV0@@Z
??0DeployPerf@@QAE@XZ
??0NativeLock@@IAE@XZ
??0NativeLocker@@QAE@PAVNativeLock@@@Z
??0PerfHelper@@QAE@ABV0@@Z
??0PerfHelper@@QAE@XZ
??0PerfLabel@@QAE@ABV0@@Z
??0PerfLabel@@QAE@XZ
??0PerfLabel@@QAE@_JPBD@Z
??0PerfStore@@QAE@ABV0@@Z
??0PerfStore@@QAE@XZ
??0SystemTime@@QAE@ABV0@@Z
??0SystemTime@@QAE@XZ
??0WinLock@@QAE@XZ
??0WinTime@@QAE@ABV0@@Z
??0WinTime@@QAE@XZ
??1BasicPerfHelper@@UAE@XZ
??1BasicPerfStore@@UAE@XZ
??1DeployPerf@@UAE@XZ
??1NativeLock@@MAE@XZ
??1NativeLocker@@QAE@XZ
??1PerfHelper@@UAE@XZ
??1PerfStore@@UAE@XZ
??1SystemTime@@UAE@XZ
??1WinLock@@UAE@XZ
??1WinTime@@UAE@XZ
??4DeployPerf@@QAEAAV0@ABV0@@Z
??4NativeLocker@@QAEAAV0@ABV0@@Z
??4PerfHelper@@QAEAAV0@ABV0@@Z
??4PerfLabel@@QAEAAV0@ABV0@@Z
??4PerfStore@@QAEAAV0@ABV0@@Z
??4SystemTime@@QAEAAV0@ABV0@@Z
??4WinTime@@QAEAAV0@ABV0@@Z
??_7BasicPerfHelper@@6B@
??_7BasicPerfStore@@6B@
??_7DeployPerf@@6B@
??_7NativeLock@@6B@
??_7PerfHelper@@6B@
??_7PerfStore@@6B@
??_7SystemTime@@6B@
??_7WinLock@@6B@
??_7WinTime@@6B@
?LABEL_BUFFER_SIZE@PerfLabel@@2IB
?MAX_LABEL_COUNT@BasicPerfStore@@0IB
?_get@BasicPerfStore@@ABE?AVPerfLabel@@I@Z
?acquire@WinLock@@UAEXXZ
?calculateJavaEpoch@WinTime@@CA_JXZ
?get@BasicPerfStore@@UBE?AVPerfLabel@@I@Z
?getCurrentTime@BasicPerfHelper@@UBE_JXZ
?getCurrentTime@WinTime@@UBE_JXZ
?getJavaObj@PerfLabel@@QBEPAV_jobject@@PAUJNIEnv_@@@Z
?initStore@BasicPerfHelper@@UAE_NXZ
?labelToString@PerfLabel@@QBEPAV_jstring@@PAUJNIEnv_@@@Z
?put@BasicPerfHelper@@UAEXPAUJNIEnv_@@PAV_jstring@@@Z
?put@BasicPerfHelper@@UAEXPBD@Z
?put@BasicPerfStore@@QAEXPAUJNIEnv_@@PAV_jstring@@@Z
?put@BasicPerfStore@@UAEXPBD@Z
?put@PerfHelper@@MAEXPAUJNIEnv_@@PAV_jstring@@@Z
?release@WinLock@@UAEXXZ
?size@BasicPerfStore@@UBEIXZ
?toArray@BasicPerfHelper@@UBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
?toArray@BasicPerfStore@@QBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
?toArray@PerfHelper@@MBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
GetDeployPerf
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_ExpandEnvironmentStrings@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_FindMimeFromData@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegCloseKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegCreateKeyEx@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegDeleteKey@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegDeleteValue@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegEnumKeyEx@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegEnumValue@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegFlushKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegOpenKey@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegQueryInfoKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegQueryValueEx@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegSetValueEx@20
_Java_com_sun_deploy_config_UnixConfig_getPlatformPID@8
_Java_com_sun_deploy_config_WinConfig_addRemoveProgramsAdd@36
_Java_com_sun_deploy_config_WinConfig_addRemoveProgramsRemove@16
_Java_com_sun_deploy_config_WinConfig_canDownloadJRE@8
_Java_com_sun_deploy_config_WinConfig_getBrowserHomePathImpl@8
_Java_com_sun_deploy_config_WinConfig_getBrowserPath@8
_Java_com_sun_deploy_config_WinConfig_getPlatformMaxCommandLineLength@8
_Java_com_sun_deploy_config_WinConfig_getPlatformSystemHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_getPlatformUserHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_getSysTickCount@8
_Java_com_sun_deploy_config_WinConfig_getSystemExecutableHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_installShortcut@36
_Java_com_sun_deploy_config_WinConfig_isBrowserFireFox@8
_Java_com_sun_deploy_config_WinConfig_isNativeModalDialogUp@8
_Java_com_sun_deploy_config_WinConfig_isPlatformWindowsVista@8
_Java_com_sun_deploy_config_WinConfig_notifyJREInstalled@12
_Java_com_sun_deploy_config_WinConfig_sendJFXPingImpl@40
_Java_com_sun_deploy_config_WinConfig_showDocument@12
_Java_com_sun_deploy_net_cookie_IExplorerCookieHandler_getCookieInfo@12
_Java_com_sun_deploy_net_cookie_IExplorerCookieHandler_setCookieInfo@16
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_askUserGoOnline@12
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_isGlobalOffline@8
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_setGlobalOffline@12
_Java_com_sun_deploy_net_proxy_WIExplorerAutoProxyHandler_evalScript@12
_Java_com_sun_deploy_net_proxy_WIExplorerProxyConfig_getBrowserProxySettings@8
_Java_com_sun_deploy_net_proxy_WIExplorerProxyConfig_performAutoDetection@8
_Java_com_sun_deploy_perf_NativePerfHelper_put@12
_Java_com_sun_deploy_perf_NativePerfHelper_toArray@8
_Java_com_sun_deploy_security_MSCredentialManager_decryptMSPassword@12
_Java_com_sun_deploy_security_MSCredentialManager_encryptMSPassword@12
_Java_com_sun_deploy_security_MSCredentialManager_getLoginUID@8
_Java_com_sun_deploy_security_MSCredentialManager_isEncryptionAvailable@8
_Java_com_sun_deploy_security_MSCryptoDSASignature_nativeSignHash@24
_Java_com_sun_deploy_security_MSCryptoNONEwithRSASignature_nativeSignHash@24
_Java_com_sun_deploy_security_MSCryptoRSAKey_cleanUp@16
_Java_com_sun_deploy_security_WIExplorerBrowserAuthenticator14_getAuthentication@12
_Java_com_sun_deploy_security_WIExplorerBrowserAuthenticator_getAuthFromInet@28
_Java_com_sun_deploy_security_WIExplorerCertStore_loadCertificates@20
_Java_com_sun_deploy_security_WIExplorerMyKeyStore_loadKeysAndCertificateChains@16
_Java_com_sun_deploy_security_WSeedGenerator_generateSeed@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_appendMenu@32
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_createNativeIcon@28
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_createPopupMenu@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_createWindow@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_defWindowProc@36
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_destroyIcon@16
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_getCurrentProcessId@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_hasBalloonTooltipShown0@16
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_isBalloonClickInBounds@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_isEnabled0@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_mainLoop@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_modifyMenu@32
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_notifyShell@60
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_openControlPanel@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_postQuitMessage@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_registerClass@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_setBalloonTooltipShown0@20
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_setMenuDefaultItem@24
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_setUserData@16
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_showPopupMenu@24
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_showSysTray@16
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_showWindow@20
_Java_com_sun_deploy_util_ConsoleHelper_dumpAllStacksImpl@8
_Java_com_sun_deploy_util_ConsoleHelper_preMustangDumpAllStacksImpl@8
_Java_com_sun_deploy_util_WinRegistry_getWindowsDirectory@8
_Java_com_sun_deploy_util_WinRegistry_initIDs@8
_Java_com_sun_deploy_util_WinRegistry_sysCloseKey@12
_Java_com_sun_deploy_util_WinRegistry_sysCreateKey@20
_Java_com_sun_deploy_util_WinRegistry_sysDeleteKey@16
_Java_com_sun_deploy_util_WinRegistry_sysOpenKey@20
_Java_com_sun_deploy_util_WinRegistry_sysQueryKey@16
_Java_com_sun_deploy_util_WinRegistry_sysReboot@8
_Java_com_sun_deploy_util_WinRegistry_sysSetStringValue@20
Sections
.text Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE