g:\Acro_root_at\bravo\public\libraries\windows\release\dynamic\agm4crtstdll\AGM.pdb
Static task
static1
Behavioral task
behavioral1
Sample
227bb80a19c5d75f1c4a2ac2cb73197b_JaffaCakes118.dll
Resource
win7-20240508-en
General
-
Target
227bb80a19c5d75f1c4a2ac2cb73197b_JaffaCakes118
-
Size
4.8MB
-
MD5
227bb80a19c5d75f1c4a2ac2cb73197b
-
SHA1
91d985ffcb93c8e98a9146fb80521e831d8cc38d
-
SHA256
b499b95c1659c7531109408a4abe4db135e43c88a7c57e10031dc49167e6e1ac
-
SHA512
604d39dadff3b98c18c834076324b2acbfa001e1a76c764e362805b0b85e790f92bed46e0469fa8bca4e0f704caaa0fd46b97cb251c03785a742086fdfed9b87
-
SSDEEP
98304:IaTiZ7qe+aOKvp3QZ6/HbS9FugmTw3gvhiWaOuBuJ0Ato4z/ukJt:IaTiZ7qfRmp3QZ6/+9Fu/v0AmWhJt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 227bb80a19c5d75f1c4a2ac2cb73197b_JaffaCakes118
Files
-
227bb80a19c5d75f1c4a2ac2cb73197b_JaffaCakes118.dll windows:4 windows x86 arch:x86
b83cdc2d1260b7d6104ddd7f9272ead4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GlobalSize
GetVersionExA
GetSystemInfo
GetTickCount
GetModuleHandleA
GetTimeFormatA
LocalAlloc
InterlockedExchange
RaiseException
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetWindowsDirectoryA
GetCurrentDirectoryA
GetFileSize
ReadFile
SetCurrentDirectoryA
IsProcessorFeaturePresent
GetProfileStringA
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock
GetSystemDefaultLCID
GetLocaleInfoA
GetACP
CreateFileA
GetFileTime
CloseHandle
GetLastError
FindFirstFileA
FindNextFileA
FindClose
GetUserDefaultLangID
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetDateFormatW
GetTimeFormatW
GetThreadLocale
GetDateFormatA
user32
CharNextA
GetDesktopWindow
GetActiveWindow
SetActiveWindow
OffsetRect
GetMonitorInfoA
MonitorFromWindow
MonitorFromPoint
ScrollWindowEx
UnregisterClassA
LoadIconA
LoadCursorA
RegisterClassA
SetWindowPos
CreateWindowExA
DestroyWindow
DefWindowProcA
WindowFromDC
GetWindowRect
GetDC
ReleaseDC
GetClientRect
GetSystemMetrics
gdi32
ResetDCA
CreateDCA
ExtEscape
StartPage
StartDocA
AbortDoc
EndPage
EndDoc
SetMiterLimit
ExtCreatePen
GetCurrentObject
Escape
PolyDraw
SelectClipPath
IntersectClipRect
GetClipBox
Rectangle
FillPath
BeginPath
EndPath
SetGraphicsMode
GetGraphicsMode
GetWorldTransform
ModifyWorldTransform
StrokePath
SetWorldTransform
MoveToEx
PolyBezierTo
CloseFigure
PolylineTo
LineTo
GetStockObject
SetPolyFillMode
StretchBlt
CreatePalette
CreateBrushIndirect
PatBlt
SelectPalette
RealizePalette
CreateDIBSection
BitBlt
GetDIBColorTable
SelectClipRgn
GetRegionData
CreateRectRgn
CombineRgn
SaveDC
ExtSelectClipRgn
SetStretchBltMode
StretchDIBits
RestoreDC
GetDeviceCaps
CreateCompatibleBitmap
GetObjectA
DeleteObject
DeleteDC
SelectObject
CreateCompatibleDC
GetViewportOrgEx
CreatePolyPolygonRgn
advapi32
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
VariantClear
VariantInit
msvcp80
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_BADOFF@std@@3JB
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?to_int_type@?$char_traits@D@std@@SAHABD@Z
?to_char_type@?$char_traits@D@std@@SADABH@Z
?eq@?$char_traits@D@std@@SA_NABD0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?_Copy_s@?$char_traits@D@std@@SAPADPADIPBDI@Z
?_Move_s@?$char_traits@D@std@@SAPADPADIPBDI@Z
?assign@?$char_traits@D@std@@SAXAADABD@Z
?_Xran@_String_base@std@@SAXXZ
?_Xlen@_String_base@std@@SAXXZ
?length@?$char_traits@D@std@@SAIPBD@Z
?_Copy_s@?$char_traits@_W@std@@SAPA_WPA_WIPB_WI@Z
?_Move_s@?$char_traits@_W@std@@SAPA_WPA_WIPB_WI@Z
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z
?length@?$char_traits@_W@std@@SAIPB_W@Z
?compare@?$char_traits@D@std@@SAHPBD0I@Z
?find@?$char_traits@D@std@@SAPBDPBDIABD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$char_traits@D@std@@SAPADPADID@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?width@ios_base@std@@QAEHH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBEHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADH@Z
?_Xsgetn_s@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADIH@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPBDH@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?not_eof@?$char_traits@D@std@@SAHABH@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
msvcr80
fseek
_stricmp
__clean_type_info_names_internal
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_CxxThrowException
memset
__CxxFrameHandler3
memcpy
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
__RTDynamicCast
_purecall
exit
_control87
fclose
malloc
free
qsort
_CIsin
_CIcos
_CIpow
_CIlog
strstr
_CIsqrt
memmove_s
wcstombs
sscanf
ferror
fgetc
fopen
toupper
memmove
strncpy
vsprintf
rand
ceil
floor
_CIfmod
_CIlog10
_CIatan2
_hypot
fread
fwrite
modf
atoi
strchr
strncmp
rename
remove
setbuf
ftell
fputs
fflush
feof
isdigit
freopen
ungetc
getc
_ltoa
strtok
_strupr
fprintf
__iob_func
calloc
_CIatan
realloc
_unlock
_encode_pointer
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_malloc_crt
shlwapi
PathAppendA
PathRemoveFileSpecA
Exports
Exports
??4_Init_locks@std@@QAEAAV01@ABV01@@Z
AGMGetVersion
AGMInitialize
AGMTerminate
Sections
.text Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 131KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 281KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 118KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE