n:\PCS_v16-5-13\ccs\program\con2con.exe\wint\con2con.pdb
Static task
static1
Behavioral task
behavioral1
Sample
158c716b66917a9e578884ae53c9917b_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
158c716b66917a9e578884ae53c9917b_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
158c716b66917a9e578884ae53c9917b_JaffaCakes118
-
Size
56KB
-
MD5
158c716b66917a9e578884ae53c9917b
-
SHA1
0c6928a79839638c5664c8e3d72674d40c193cff
-
SHA256
8689f72e733ed8cde6437631514dc141bf997ef6eebdf50d982ce4dd1f1a23e2
-
SHA512
8cbcbef1c6609f2270c077700b7b4af56a8d420d9ca07ba0a8ae26375d67c4151c29e2135a360c3f323edbb28548d25be581b3afeee5a4aca383293e6c41c721
-
SSDEEP
768:MYg/HiXgMm8bOJPmP3jYibowK150vi+I/xDI4BVQIk9OFD9gYBVJJP2b:MYOHvlhy3Ua05eeD58LOFDHBVJZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 158c716b66917a9e578884ae53c9917b_JaffaCakes118
Files
-
158c716b66917a9e578884ae53c9917b_JaffaCakes118.exe windows:4 windows x86 arch:x86
c82618fb7babff786ca8c83f26557963
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mfc80
ord1207
ord4038
ord4014
ord6278
ord3801
ord6276
ord4326
ord2063
ord2018
ord5583
ord3806
ord764
ord5102
ord6219
ord5382
ord3832
ord1920
ord2931
ord5224
ord5226
ord3948
ord4568
ord5230
ord5213
ord5566
ord2537
ord2731
ord2835
ord4307
ord2714
ord2838
ord2540
ord2646
ord2533
ord2990
ord3718
ord3719
ord3709
ord2644
ord3949
ord4481
ord4261
ord3333
ord566
ord757
ord762
ord1191
ord1187
ord1185
ord1010
ord1084
msvcr80
malloc
free
wcscpy_s
__CxxFrameHandler3
calloc
_setmbcp
_controlfp_s
_invoke_watson
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
_except_handler4_common
wcslen
__argv
__argc
__iob_func
fprintf
fflush
exit
_resetstkoflw
_recalloc
kernel32
TerminateProcess
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
MultiByteToWideChar
WideCharToMultiByte
GetLastError
GetVersion
lstrlenW
CompareStringA
CompareStringW
lstrcmpiA
lstrcmpiW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
GetLocalTime
GetStringTypeExW
GetStringTypeExA
GetEnvironmentVariableW
GetEnvironmentVariableA
lstrlenA
GetVersionExA
user32
CharUpperW
CharUpperA
CharLowerW
CharLowerA
oleaut32
SysFreeString
lupdvbase
?writeCell@LDPdvDMPI@@QAE_NPAVLBString@@0PAVLACellViewFilter@@H_N22V2@22@Z
?execECOBetweenCells@LDPdvDMPI@@QAE_NPAVLBString@@00000@Z
?setDMRootLibName@LDPdvDMPI@@QAE_NPAVLBString@@0AAPAVLA5xParser@@@Z
?saveCellAs@LDPdvDMPI@@QAE_NPAVLBString@@0PAVLACellViewFilter@@_N2@Z
?initTranslation@LDPdvDMPI@@SAXXZ
?createDMPI@LDPdvDMPI@@SA_NAAPAV1@@Z
?autoRecognizeCreateDiffPairs@LDPdvDMPI@@QAEXPAVLBString@@_N@Z
?deleteDMPI@LDPdvDMPI@@SA_NAAPAV1@@Z
?closeCell@LDPdvDMPI@@QAE_NPAVLBString@@0PAVLACellViewFilter@@H@Z
ldatamodel
?getSymbolList@LDCell@@QAEXPAVLBList@@H@Z
?objectHasError@LDUtil@@SA_NPAVLDDbObject@@@Z
labackend
?initPsm@LABackendUtil@@SAXABVLBString@@@Z
lafetbase
??0LALicense@@QAE@PAVLBString@@@Z
?checkOut@LALicense@@QAE_NPAVLBStatus@@_N@Z
?getCheckedOutLicense@LAFetbaseUtil@@SAXPAVLBString@@@Z
?checkIn@LALicense@@QAEXXZ
??1LALicense@@UAE@XZ
?getNextLib@LA5xParser@@QAE_NPAVLBString@@@Z
?startCellIter@LA5xParser@@QAE_NPBD@Z
?lmanFilesysToConcept@LAFetbaseUtil@@SAPAVLBStatus@@PBDPAVLBString@@PAV2@@Z
?getNextCell@LA5xParser@@QAE_NPAVLBString@@@Z
?lmanCdsInit@LAFetbaseUtil@@SAPAVLBStatus@@PADPAV2@@Z
?startLibIter@LA5xParser@@QAE_NXZ
lbase
?getIntersectionWith@LBObject@@UAEPAV1@PAV1@0@Z
?clone@LBObject@@UAEPAV1@XZ
?mergeObj@LBObject@@UBEXPAV1@@Z
?getUnionWith@LBObject@@UAEPAV1@PAV1@0@Z
?serializeXML@LBObject@@UAEXPAVLBString@@@Z
?toString@LBFileOutputStream@@UAEPAVLBString@@PAV2@@Z
?lock@LBObject@@UAE_NK@Z
?isKindOf@LBFileOutputStream@@UBE_NPAD@Z
?isEqual@LBObject@@UAE_NPAV1@H@Z
?getObjectKey@LBObject@@UAEPAXXZ
?getClassName@LBFileOutputStream@@UBEPAVLBString@@XZ
?find@LBString@@QBEHPAD_N@Z
?left@LBString@@QBEPAV1@HPAV1@@Z
?getChar@LBString@@QBEPADXZ
?format@LBString@@QAAPAV1@PADZZ
??0LBFileOutputStream@@QAE@PAVLBString@@W4FileMode@0@@Z
??0LBStatus@@QAE@XZ
??BLBString@@QAEPADXZ
??4LBString@@QAEABV0@ABV0@@Z
??1LBStatus@@UAE@XZ
??0LBString@@QAE@XZ
??1LBListString@@UAE@XZ
??0LBListString@@QAE@_N00H@Z
?unlock@LBObject@@UAE_NXZ
?cleanMemoryStack@LBString@@SAXXZ
?toString@LBObject@@UAEPAVLBString@@PAV2@@Z
?isKindOf@LBObject@@UBE_NPAD@Z
?getClassName@LBObject@@UBEPAVLBString@@XZ
?append@LBString@@QAEXPAD@Z
?find@LBListString@@QAE_NPAVLBString@@_N@Z
?compareNoCase@LBString@@QBEHPAD_N@Z
??1LBMessage@@UAE@XZ
?toString@LBMessage@@UAEPAVLBString@@PAV2@@Z
?isKindOf@LBMessage@@UBE_NPAD@Z
?isEqual@LBMessage@@UAE_NPAVLBObject@@H@Z
?getClassName@LBMessage@@UBEPAVLBString@@XZ
??0LBArrayOb@@QAE@_N00@Z
?add@LBArrayOb@@UAEPAVLBObject@@PAV2@@Z
??0LBMessage@@QAE@PAD0PAX11@Z
?addMessage@LBObject@@SAXPAX@Z
?showMessage@LBObject@@SAXXZ
??1LBArrayOb@@UAE@XZ
??0LBString@@QAE@PBD@Z
?attachObserver@LBObject@@UAEXPAV1@@Z
?detachObserver@LBObject@@UAEXPAV1@@Z
?notifyObservers@LBObject@@UAEXPAV1@K0@Z
?update@LBObject@@UAEXPAV1@K0@Z
?close@LBFileOutputStream@@UAEXXZ
?open@LBFileOutputStream@@UAEXXZ
?open@LBStream@@UAEPAVLBStatus@@PAV2@@Z
?read@LBStream@@UAEHPADH@Z
?flush@LBFileOutputStream@@UAEXXZ
?write@LBFileOutputStream@@UAE_NPADH@Z
?writeLine@LBFileOutputStream@@UAE_NPAVLBString@@@Z
?writeLine@LBFileOutputStream@@UAE_NPAD@Z
??1LBFileOutputStream@@UAE@XZ
?compareNoCase@LBString@@QBEHPAV1@_N@Z
?isEmpty@LBString@@QBE_N_N@Z
?getMessageId@LBMessage@@QAEPAVLBString@@XZ
?getDesc@LBMessage@@QAEPAVLBString@@XZ
?getType@LBMessage@@QAE?AW4MessageType@1@XZ
?empty@LBString@@QAEXXZ
?removeAll@LBListOb@@UAEXXZ
??0LBListOb@@QAE@_N00@Z
?getClassName@LBListOb@@UBEPAVLBString@@XZ
?isEqual@LBListOb@@UAE_NPAVLBObject@@H@Z
?isKindOf@LBListOb@@UBE_NPAD@Z
?clone@LBListOb@@UAEPAVLBObject@@XZ
?serializeXML@LBListOb@@UAEXPAVLBString@@@Z
?toString@LBListOb@@UAEPAVLBString@@PAV2@@Z
?add@LBListOb@@UAEPAVLBObject@@PAV2@@Z
?addHead@LBListOb@@UAEPAVLBObject@@PAV2@@Z
?find@LBListOb@@UAEPAVLBObject@@PAV2@PAVLBPosition@@@Z
??0LBString@@QAE@ABV0@@Z
??1LBListOb@@UAE@XZ
?append@LBListOb@@UAEXPAVLBList@@@Z
?getArray@LBList@@UAEPAVLBArray@@PAV2@@Z
?unlink@LBListOb@@UAEXPAVLBObject@@@Z
?setAt@LBListOb@@UAEXPAVLBObject@@PAVLBPosition@@@Z
?removeAt@LBListOb@@UAE_NPAVLBPosition@@@Z
??4LBString@@QAEABV0@PBD@Z
??1LBString@@UAE@XZ
?findObj@LBList@@UAE_NPAVLBObject@@@Z
?getAt@LBListOb@@UAEPAVLBObject@@H@Z
?getAt@LBListOb@@UAEPAVLBObject@@PAVLBPosition@@@Z
?getNamedObject@LBListOb@@UAEPAVLBTreeNode@@PAVLBString@@AAPAV2@_N@Z
?getNext@LBListOb@@UAEPAVLBObject@@PAVLBPosition@@@Z
?getPrev@LBListOb@@UAEPAVLBObject@@PAVLBPosition@@@Z
?getPosition@LBListOb@@UAEPAVLBPosition@@HPAV2@@Z
?getSize@LBListOb@@UAEHXZ
?initPosition@LBListOb@@UAEXPAVLBPosition@@@Z
?insertAfter@LBListOb@@UAEPAVLBObject@@PAV2@PAVLBPosition@@@Z
?insertAt@LBListOb@@UAEPAVLBObject@@HPAV2@@Z
?insertBefore@LBListOb@@UAEPAVLBObject@@PAV2@PAVLBPosition@@@Z
?remove@LBListOb@@UAE_NPAVLBObject@@@Z
?deleteInstance@LBGlobalData@@SAXXZ
ldmpi
?getBuildLibList@LDLibDMPI@@QAE_NAAPAVLBListString@@AAPAVLA5xParser@@@Z
??0LACellViewFilter@@QAE@XZ
?addLibrary@LDLibDMPI@@QAE_NPAD@Z
?setObjContext@LDLibDMPI@@QAE_NHPAD@Z
?addCell@LDLibDMPI@@QAE_NPADPAX@Z
??1LACellViewFilter@@UAE@XZ
?getErrorList@LDLibDMPI@@QAEXAAPAVLBListOb@@PAX@Z
?getObjContext@LDLibDMPI@@QAEPAXHPAD@Z
?setBaselined@LDLibDMPI@@QAEX_NPAX@Z
ldconceptdmpi
??0LDLoadDMPI@@QAE@XZ
?openLibCellView@LDLoadDMPI@@QAE_NPAVLBArrayOb@@PAVLACellViewFilter@@_N222H@Z
??1LDLoadDMPI@@UAE@XZ
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ