d:\cm\build\public\imapp_6_1_41_070427\boxelyUI\imApp\src\imAppService\Release\imAppService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
09baa21e7b98c029585c22aae4b4c433_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
09baa21e7b98c029585c22aae4b4c433_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
09baa21e7b98c029585c22aae4b4c433_JaffaCakes118
-
Size
1.4MB
-
MD5
09baa21e7b98c029585c22aae4b4c433
-
SHA1
dd7d44f0f95bf3567c168007d3a39db056078290
-
SHA256
5bd69c79160c97016d82e9f5700d150247098556fed147aa5942ae6e5b6066a3
-
SHA512
cfefdfb597981bc95480dda318c960b30aa6e3fad3166498f1f5d739e9f62f1200070beb8f18372669cd5ebc34bdfc8ed8f28f77327161110973f1d1f1dc7589
-
SSDEEP
24576:K3Ysks2r7wuqcXpisN+5id6FqcNxVZD58jMDbiZJlZTqY/fSWA:K3Ysksawsp2Id6FvlElZT/Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09baa21e7b98c029585c22aae4b4c433_JaffaCakes118
Files
-
09baa21e7b98c029585c22aae4b4c433_JaffaCakes118.dll windows:4 windows x86 arch:x86
ee47f99b36c077f8ada748216d0821d9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
xprt5
?Append@TBstr@XPRT@@QAEAAV12@PBGH@Z
xprt_isalnum
?CreateDirectoryA@TFile@XPRT@@SA_NPBG@Z
?GetLength@TFile@XPRT@@UBE_JXZ
xprt_strchr
?GetFileSpec@TFileFinder@XPRT@@QBE?AVTBstr@2@XZ
??1TConvertFromUcs2@XPRT@@QAE@XZ
_XprtStringLen@4
_XprtEntityEscape@8
_XprtEntityUnescape@8
?Find@TPtrList@XPRT@@QBEPAU__POSITION@2@PAXPAU32@@Z
_XprtCompareWildcard@8
?Copy@TPtrArray@XPRT@@QAEXABV12@@Z
?GetRawBstrPtr@TBstr@XPRT@@QAEPAPAGXZ
?Remove@TBstr@XPRT@@QAEHG@Z
?GetTempDirectory@TFile@XPRT@@SA?AVTBstr@2@XZ
?Remove@TFile@XPRT@@SA_NPBG@Z
?GetEncodedByteLength@TBstr@XPRT@@QBEHPBG@Z
?GetDay@TTime@XPRT@@QBEHXZ
?Format@TTime@XPRT@@QBE?AVTBstr@2@PBG@Z
?FormatV@TBstr@XPRT@@QAEXPBGPAD@Z
?RemoveHead@TPtrList@XPRT@@QAEPAXXZ
??0TXmlDeserializer@XPRT@@QAE@AAVTStream@1@@Z
?Deserialize@TXmlSerializable@XPRT@@QAE_NAAVTXmlDeserializer@2@@Z
_XprtAtomicIncrement@4
_XprtAtomicDecrement@4
xprt_strcmp
xprt_iswdigit
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
_XprtInitialize@8
_XprtUninitialize@0
?Unlock@TSpinLock@XPRT@@QAEXXZ
?Lock@TSpinLock@XPRT@@QAEXXZ
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?IsOpen@TFile@XPRT@@QBE_NXZ
?Copy@TBstr@XPRT@@QBEPAGXZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
_XprtCreateThread@8
_XprtDestroyThread@8
?AddHead@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
?InsertBefore@TPtrList@XPRT@@QAEPAU__POSITION@2@PAU32@PAX@Z
?InsertAfter@TPtrList@XPRT@@QAEPAU__POSITION@2@PAU32@PAX@Z
?FindIndex@TPtrList@XPRT@@QBEPAU__POSITION@2@H@Z
XML_ErrorString
XML_GetErrorCode
XML_GetCurrentLineNumber
XML_Parse
XML_ParserFree
XML_SetElementHandler
XML_SetUserData
XML_ParserCreate
?TrimRight@TBstr@XPRT@@QAEAAV12@G@Z
??1TXmlDeserializer@XPRT@@UAE@XZ
??3TXprtAllocated@XPRT@@SAXPAX@Z
?SetValueAt@TPtrFromPtrMap@XPRT@@QAEXPAU__POSITION@2@PAX@Z
_XprtHtmlToPlain@8
?ToInt@TBstr@XPRT@@QBEHH@Z
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBGH@Z
?Right@TBstr@XPRT@@QBE?AV12@H@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@G@Z
_XprtUrlDecode@8
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
xprt_memset
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
_XprtUrlEncode@8
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
xprt_memmove
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
_XprtHashString@4
_XprtHexToBin@16
??0TConvertFromUcs2@XPRT@@QAE@PBG0@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
?IsValid@TTime@XPRT@@QBE_NXZ
?Set@TTime@XPRT@@QAEXHHHHHH@Z
?Set@TTime@XPRT@@QAEXN@Z
?InsertAt@TPtrArray@XPRT@@QAEXHPAXH@Z
?RemoveAt@TPtrArray@XPRT@@QAEXHH@Z
?Sort@TPtrArray@XPRT@@QAEXW4ESortOrder@2@@Z
??0TFileFinder@XPRT@@QAE@XZ
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
?Find@TFileFinder@XPRT@@QAE_NPBGI@Z
?FindNext@TFileFinder@XPRT@@QAE_NI@Z
??1TFileFinder@XPRT@@UAE@XZ
?FindOneOf@TBstr@XPRT@@QBEHPBG@Z
?GetBestEncoding@TBstr@XPRT@@QBE?AV12@XZ
kUtf8Encoding
??0TFile@XPRT@@QAE@XZ
?Open@TFile@XPRT@@QAE_NPBGI_N@Z
??1TFile@XPRT@@UAE@XZ
?Write@TFile@XPRT@@UAEHPBXH@Z
?Close@TFile@XPRT@@UAE_NXZ
?AppendFormat@TBstr@XPRT@@QAAXPBGZZ
?Tokenize@TBstr@XPRT@@QBE?AV12@PBGAAH@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?Replace@TBstr@XPRT@@QAEHPBG0@Z
?Insert@TBstr@XPRT@@QAEHHPBG@Z
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
?CreatePath@TFile@XPRT@@SA_NPBG@Z
_XprtBinToHex@16
_XprtMemAlloc@4
xprt_wcsncmp
xprt_wcschr
xprt_wcstol
_XprtBase64ToBin@12
xprt_snwprintf
??0TBstr@XPRT@@QAE@GH@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
xprt_wcslen
xprt_ucslcpy
xprt_wcstoul
_XprtBinToBase64@16
??0TBstr@XPRT@@QAE@PBGH@Z
?GetTickCount@TTime@XPRT@@SA?AV12@XZ
?GetBstrPtr@TBstr@XPRT@@QAEPAPAGXZ
?RemoveAt@TPtrList@XPRT@@QAEXPAU__POSITION@2@@Z
?CompareNormal@TBstr@XPRT@@QBEHPBG@Z
?GetTime64@TTime@XPRT@@QBE_JXZ
?GetInfo@TFile@XPRT@@SA_NPBGAAVTFileInfo@2@@Z
?FileNameFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
?Empty@TBstr@XPRT@@QAEXXZ
?RemoveHeadNoReturn@TPtrList@XPRT@@QAEXXZ
?Normalize@TBstr@XPRT@@QAEAAV12@XZ
?MakeLower@TBstr@XPRT@@QAEAAV12@XZ
?Delete@TBstr@XPRT@@QAEHHH@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
_XprtMemFree@4
?AddTail@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
?RemoveAll@TPtrList@XPRT@@QAEXXZ
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
_XprtCompareString@8
_XprtFreeString@4
_XprtAllocString@4
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?Init@TFileInfo@XPRT@@IAEXPBGI_JABVTTime@2@22@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
?Find@TBstr@XPRT@@QBEHPBGH@Z
?Format@TBstr@XPRT@@QAAXPBGZZ
?kDirectorySeparator@TFile@XPRT@@2GB
?Replace@TBstr@XPRT@@QAEHGG@Z
?Insert@TBstr@XPRT@@QAEHHG@Z
?SetAt@TBstr@XPRT@@QAEXHG@Z
??1TPtrArray@XPRT@@QAE@XZ
??0TPtrArray@XPRT@@QAE@XZ
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
?SafeToConvert@TFile@XPRT@@SA_NPBG@Z
_XprtGetSystemInfo@0
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetAt@TBstr@XPRT@@QBEGH@Z
xprt_strlen
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??1TPtrList@XPRT@@QAE@XZ
??0TPtrList@XPRT@@QAE@H@Z
??0TBstr@XPRT@@QAE@XZ
??0TBstr@XPRT@@QAE@PBDPBG@Z
?ReverseFind@TBstr@XPRT@@QBEHG@Z
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
xprt_wcsstr
??0TLibrary@XPRT@@QAE@XZ
?Load@TLibrary@XPRT@@QAE_NPBG@Z
?IsLoaded@TLibrary@XPRT@@QBE_NXZ
?GetProcAddress@TLibrary@XPRT@@QBEP6GHXZPBD@Z
??1TLibrary@XPRT@@UAE@XZ
??0TBstr@XPRT@@QAE@PBG@Z
?CompareNoCase@TBstr@XPRT@@QBEHPBG@Z
?Find@TPtrArray@XPRT@@QBEHPAXH@Z
_XprtGetMilliseconds@0
??1TBstr@XPRT@@QAE@XZ
kSystemEncoding
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
rpcrt4
UuidCreate
UuidFromStringW
UuidToStringA
RpcStringFreeA
dsound
ord6
kernel32
DisableThreadLibraryCalls
GetVersionExA
VirtualQuery
VirtualProtect
lstrcmpiA
IsBadWritePtr
TerminateThread
WaitForSingleObject
FreeLibrary
ReadFile
ReleaseSemaphore
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
FindClose
CreateThread
ExitThread
SetEvent
CloseHandle
GetLastError
GetCurrentThreadId
GetCurrentProcess
SetProcessWorkingSetSize
GetCurrentProcessId
GetTickCount
HeapDestroy
LoadLibraryA
RemoveDirectoryA
ResetEvent
InterlockedCompareExchange
CompareStringA
GetSystemTimeAsFileTime
QueryPerformanceCounter
ExitProcess
EnumSystemLocalesA
LCMapStringA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
SetLastError
InterlockedDecrement
InterlockedIncrement
lstrlenA
lstrcatA
lstrcpyA
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetModuleHandleA
user32
GetWindowThreadProcessId
MessageBeep
GetSystemMetrics
MonitorFromPoint
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetWindowTextA
SetForegroundWindow
AttachThreadInput
GetWindow
EnumWindows
GetAncestor
MsgWaitForMultipleObjects
SetTimer
KillTimer
DestroyWindow
ReleaseDC
GetCursorPos
PostQuitMessage
IsWindow
IsWindowVisible
GetClientRect
ClientToScreen
WindowFromPoint
CharNextA
IsChild
GetDesktopWindow
TranslateMessage
GetForegroundWindow
GetDC
DestroyIcon
gdi32
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
GetPixel
SetPixel
CreateDIBSection
DeleteDC
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
shell32
SHGetFolderPathW
SHCreateDirectoryExW
ole32
CoRegisterClassObject
CoRevokeClassObject
CoInitializeEx
CoRegisterMessageFilter
StringFromCLSID
CoTaskMemFree
CreateBindCtx
CoInitialize
CoUninitialize
CoCreateInstance
oleaut32
SafeArrayDestroy
SafeArrayUnlock
SafeArrayPutElement
SafeArrayGetElement
SafeArrayRedim
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
VariantTimeToSystemTime
SysFreeString
SysAllocString
SafeArrayCopy
VariantCopy
VariantInit
VariantClear
VariantChangeType
VarCmp
SafeArrayLock
DispCallFunc
SysStringLen
LoadTypeLi
SafeArrayCreate
msvcr71
pow
sqrt
log
floor
_waccess
_purecall
isdigit
_beginthread
_wcsnicmp
wcsncmp
iswpunct
iswspace
wcslen
strncmp
??_V@YAXPAX@Z
??_U@YAPAXI@Z
swscanf
_tzset
_timezone
towupper
time
srand
memset
rand
memcpy
_splitpath
_CxxThrowException
??3@YAXPAX@Z
_wsplitpath
wcscat
_wcsicmp
_wgetenv
??2@YAPAXI@Z
_vsnwprintf
wcschr
wcspbrk
printf
iswdigit
_except_handler3
free
memcmp
memmove
fclose
_wcsupr
towlower
iswalpha
_snwprintf
wcstod
_ltow
_wtoi
?terminate@@YAXXZ
wcsrchr
_wtol
strcmp
qsort
__CxxFrameHandler
_setjmp3
__CxxLongjmpUnwind
longjmp
fprintf
_iob
sprintf
malloc
strncpy
fwrite
__CppXcptFilter
strlen
calloc
realloc
fread
strcpy
fflush
fabs
sscanf
getenv
strtod
fseek
tmpfile
_resetstkoflw
wcsncpy
_mbschr
wcsncat
wcscpy
wcscmp
wcstoul
strstr
_strcmpi
strchr
strtoul
_vsnprintf
__security_error_handler
__dllonexit
_onexit
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
wcsstr
msvfw32
DrawDibClose
DrawDibOpen
urlmon
RegisterBindStatusCallback
CreateURLMoniker
Exports
Exports
EEGetModuleInterop
EEMain
EERelaunchHandler
Sections
.text Size: 972KB - Virtual size: 971KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 176KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 152KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE