C:\Users\mrogowsk\Desktop\RapidFire_SDK-master\RapidFire\bin\VS2015\x64\Release\RapidFire64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
19e853a7fe1d0ee4706c0c4d37019920_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
19e853a7fe1d0ee4706c0c4d37019920_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
19e853a7fe1d0ee4706c0c4d37019920_JaffaCakes118
-
Size
569KB
-
MD5
19e853a7fe1d0ee4706c0c4d37019920
-
SHA1
35beddd21d183ba26fc8a28bdd09f67c94a4eec4
-
SHA256
4204719c98cd4361317607eb91f880be2fb3665edc7ac93f221f60666b3c8b2a
-
SHA512
dd639b7e0714ef182ba98031c7a62eac03a824d4e57c84a5d6ea866f6c35cf52b3e2554316e06b5f0bf29a557704654f3eacd5760fc5140108cb42c8d139de60
-
SSDEEP
12288:WnOslYfx64CP5XO7zUmXnQa4KooVbQLI+roxRHB1kVtaWOX5wzFRL/sXjH+5D0Ca:Ns+X5wzF2XjH+t0Cpsoop
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 19e853a7fe1d0ee4706c0c4d37019920_JaffaCakes118
Files
-
19e853a7fe1d0ee4706c0c4d37019920_JaffaCakes118.dll windows:6 windows x64 arch:x64
2dde5b766e1bdd83e660f63c39193d8c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
opengl32
glGetString
glGetIntegerv
glTexParameteriv
glTexImage2D
glTexParameterf
glDrawArrays
glDeleteTextures
glFinish
wglGetProcAddress
glGetTexLevelParameteriv
glGenTextures
glBindTexture
glViewport
wglMakeCurrent
wglDeleteContext
wglCreateContext
wglGetCurrentDC
wglGetCurrentContext
opencl
clCreateBuffer
clCreateProgramWithBinary
clWaitForEvents
clFinish
clGetDeviceIDs
clEnqueueCopyBuffer
clCreateCommandQueue
clReleaseKernel
clEnqueueReleaseGLObjects
clReleaseProgram
clReleaseCommandQueue
clCreateContext
clEnqueueMapBuffer
clSetKernelArg
clGetImageInfo
clCreateProgramWithSource
clEnqueueUnmapMemObject
clGetProgramInfo
clCreateKernel
clGetProgramBuildInfo
clEnqueueAcquireGLObjects
clEnqueueFillBuffer
clReleaseMemObject
clGetDeviceInfo
clGetPlatformInfo
clGetPlatformIDs
clEnqueueCopyImageToBuffer
clFlush
clGetExtensionFunctionAddressForPlatform
clBuildProgram
clEnqueueNDRangeKernel
clReleaseContext
clReleaseEvent
clCreateFromGLTexture
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
kernel32
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
ResetEvent
CreateThread
LoadLibraryA
TerminateThread
GetExitCodeThread
WaitForSingleObject
DeleteCriticalSection
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateEventA
CloseHandle
SetEvent
WaitForMultipleObjects
GetLocalTime
FindClose
FindNextFileA
FindFirstFileA
WideCharToMultiByte
FreeLibrary
Sleep
MultiByteToWideChar
GetLastError
GetModuleHandleA
GetModuleFileNameA
GetProcAddress
LoadLibraryW
user32
LoadCursorA
GetIconInfo
GetCursorInfo
EnumDisplaySettingsA
gdi32
DeleteObject
GetObjectA
DeleteDC
ChoosePixelFormat
CreateDCA
SetPixelFormat
GetBitmapBits
ole32
CoTaskMemFree
CoTaskMemAlloc
msvcp140
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_destroy
_Cnd_wait
_Mtx_init
_Thrd_start
_Thrd_id
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
_Cnd_init
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?eof@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?setf@ios_base@std@@QEAAHHH@Z
??Bios_base@std@@QEBA_NXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?fail@ios_base@std@@QEBA_NXZ
?rdstate@ios_base@std@@QEBAHXZ
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
_Thrd_join
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
_Cnd_signal
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
_Mtx_destroy
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_BADOFF@std@@3_JB
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
vcruntime140
_CxxThrowException
__std_type_info_destroy_list
__std_exception_destroy
memset
memmove
__std_terminate
memcmp
__RTDynamicCast
__vcrt_InitializeCriticalSectionEx
__C_specific_handler
__CxxFrameHandler3
_purecall
memchr
memcpy
__std_exception_copy
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_seh_filter_dll
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_errno
exit
terminate
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vswprintf
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fwrite
__acrt_iob_func
fgetc
__stdio_common_vsprintf_s
fclose
fflush
fputc
__stdio_common_vfprintf
__stdio_common_vsscanf
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
remove
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
strncpy
wcsncpy
strcmp
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-math-l1-1-0
ceilf
Exports
Exports
rfCreateEncodeSession
rfCreateEncoder
rfCreateEncoder2
rfDeleteEncodeSession
rfEncodeFrame
rfGetEncodeParameter
rfGetEncodedFrame
rfGetMouseData
rfGetMouseData2
rfGetRenderTargetState
rfGetSourceFrame
rfRegisterRenderTarget
rfReleaseEvent
rfRemoveRenderTarget
rfResizeSession
rfSetEncodeParameter
Sections
.text Size: 319KB - Virtual size: 319KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 179KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ