O:\OOO330\ooo\filter\wntmsci12.pro\bin\idxmi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
09b4c97d522320cb42d48bbca1920236_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
09b4c97d522320cb42d48bbca1920236_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
09b4c97d522320cb42d48bbca1920236_JaffaCakes118
-
Size
60KB
-
MD5
09b4c97d522320cb42d48bbca1920236
-
SHA1
a340d65fec26854eed26f83d5ac8b50823e67a66
-
SHA256
aa61e3e34468eda1734529f222a175fbf2dabc3bdad2be4fb162dc0574d28292
-
SHA512
0a5c619a8a342d5c74d5880928260554c58c4440fe30e19e2c3132c2eff3e07793b5b1efb6744116a08a26c2028551d431b6b7ac57862cb3ca981d39bd33d8e5
-
SSDEEP
768:22nrHnXr5ioNPYFZXVfw0OyP/JPZAD4ssZyrybLLA6guUSVFxQfruCft5ciUBTPB:2L0+1Vf3NBA1nrbeOzuGPciUdpGOGG8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09b4c97d522320cb42d48bbca1920236_JaffaCakes118
Files
-
09b4c97d522320cb42d48bbca1920236_JaffaCakes118.dll windows:5 windows x86 arch:x86
d44b6302548b453d61636f8ba13a341c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
vclmi
?SetStyle@LineInfo@@QAEXW4LineStyle@@@Z
?SetWidth@LineInfo@@QAEXJ@Z
?SetDashCount@LineInfo@@QAEXG@Z
?SetDashLen@LineInfo@@QAEXJ@Z
?SetDotCount@LineInfo@@QAEXG@Z
?SetDotLen@LineInfo@@QAEXJ@Z
?SetDistance@LineInfo@@QAEXJ@Z
??1VirtualDevice@@UAE@XZ
?SetRelativeMapMode@OutputDevice@@UAEXABVMapMode@@@Z
?SetMapMode@OutputDevice@@UAEXXZ
?SetMapMode@OutputDevice@@UAEXABVMapMode@@@Z
?SetSettings@OutputDevice@@UAEXABVAllSettings@@@Z
??0VirtualDevice@@QAE@G@Z
?EnableOutput@OutputDevice@@QAEXE@Z
?Record@GDIMetaFile@@QAEXPAVOutputDevice@@@Z
?Stop@GDIMetaFile@@QAEXXZ
??0MapMode@@QAE@W4MapUnit@@@Z
??4MapMode@@QAEAAV0@ABV0@@Z
??1MapMode@@QAE@XZ
?DrawPolyPolygon@OutputDevice@@QAEXABVPolyPolygon@@@Z
?DrawText@OutputDevice@@QAEXABVPoint@@ABVString@@GGPAV?$vector@VRectangle@@V?$allocator@VRectangle@@@_STL@@@_STL@@PAV3@@Z
?DrawPolygon@OutputDevice@@QAEXABVPolygon@@@Z
?DrawArc@OutputDevice@@QAEXABVRectangle@@ABVPoint@@1@Z
?DrawEllipse@OutputDevice@@QAEXABVRectangle@@@Z
?DrawPolyLine@OutputDevice@@QAEXABVPolygon@@@Z
?DrawPixel@OutputDevice@@QAEXABVPoint@@@Z
??0LineInfo@@QAE@W4LineStyle@@J@Z
??4LineInfo@@QAEAAV0@ABV0@@Z
??1LineInfo@@QAE@XZ
?DrawLine@OutputDevice@@QAEXABVPoint@@0ABVLineInfo@@@Z
?DrawLine@OutputDevice@@QAEXABVPoint@@0@Z
??0Font@@QAE@XZ
??1Font@@QAE@XZ
?SetColor@Font@@QAEXABVColor@@@Z
?SetTransparent@Font@@QAEXE@Z
?SetFamily@Font@@QAEXW4FontFamily@@@Z
?SetSize@Font@@QAEXABVSize@@@Z
?SetAlign@Font@@QAEXW4TextAlign@@@Z
?SetOrientation@Font@@QAEXF@Z
??8Font@@QBEEABV0@@Z
??4Font@@QAEAAV0@ABV0@@Z
?SetFont@OutputDevice@@QAEXABVFont@@@Z
?SetLineColor@OutputDevice@@QAEXABVColor@@@Z
?SetFillColor@OutputDevice@@QAEXABVColor@@@Z
??0GDIMetaFile@@QAE@XZ
??1GDIMetaFile@@UAE@XZ
??0Graphic@@QAE@ABVGDIMetaFile@@@Z
??4Graphic@@QAEAAV0@ABV0@@Z
??1Graphic@@UAE@XZ
tlmi
??0Polygon@@QAE@G@Z
??1ByteString@@QAE@XZ
??1String@@QAE@XZ
??0String@@QAE@ABVByteString@@GK@Z
??0ByteString@@QAE@PBD@Z
??1PolyPolygon@@QAE@XZ
?Count@PolyPolygon@@QBEGXZ
??APolygon@@QAEAAVPoint@@G@Z
??0PolyPolygon@@QAE@GG@Z
?Seek@SvStream@@QAEKK@Z
?Append@ByteString@@QAEAAV1@D@Z
?Read@SvStream@@QAEKPAXK@Z
?GetError@SvStream@@QBEKXZ
?Erase@ByteString@@QAEAAV1@GG@Z
??0ByteString@@QAE@XZ
??1Polygon@@QAE@XZ
?Insert@PolyPolygon@@QAEXABVPolygon@@G@Z
msvcr90
memmove
free
_CIsin
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
__CxxFrameHandler3
_malloc_crt
_encode_pointer
atof
memcpy
_CIatan2
_CIsqrt
strncpy
??_U@YAPAXI@Z
??_V@YAXPAX@Z
??2@YAPAXI@Z
??3@YAXPAX@Z
_CxxThrowException
_CIcos
kernel32
GetSystemTimeAsFileTime
Sleep
InterlockedCompareExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedExchange
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
stlport_vc7145
?allocate@?$__node_alloc@$00$0A@@_STL@@SAPAXI@Z
?deallocate@?$__node_alloc@$00$0A@@_STL@@SAXPAXI@Z
Exports
Exports
GetVersionInfo
GraphicImport
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ