hhsetup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2880cc1e40b9e239801ecadf50c33f08_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2880cc1e40b9e239801ecadf50c33f08_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2880cc1e40b9e239801ecadf50c33f08_JaffaCakes118
-
Size
98KB
-
MD5
2880cc1e40b9e239801ecadf50c33f08
-
SHA1
f318cfd0f19496a70fa8bf438151ce930efed536
-
SHA256
282d29ce2e3824821536c0989c63e42fc0299ac1eb0d7a1739163eb6021f83d6
-
SHA512
1d9b054b8e3d0cef7b0c196ff57c55110116acc4acb88cf60f4b8d04ba404d64851196dfad0f167c0c2c821780a9ea203b7ad203d1c056fd7f3bce8442171c4e
-
SSDEEP
1536:FxVkkxlkdGu3A3AEnuaUdaifiwseOJVx/QPLtdOnqiVEooC3IQSbbN/83v:FxVkulksNAEuFZqeyBkLLtYcbbt83v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2880cc1e40b9e239801ecadf50c33f08_JaffaCakes118
Files
-
2880cc1e40b9e239801ecadf50c33f08_JaffaCakes118.dll windows:6 windows x86 arch:x86
ee571a664958f6c3d3b03d87bb2f2bb1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_except_handler4_common
_vsnprintf
??2@YAPAXI@Z
??_V@YAXPAX@Z
_splitpath
_amsg_exit
_initterm
free
malloc
_XcptFilter
fopen
memset
fgets
feof
fclose
atoi
??_U@YAPAXI@Z
??3@YAXPAX@Z
kernel32
GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
MultiByteToWideChar
WideCharToMultiByte
SetLastError
lstrcmpiA
DeleteFileA
GetDriveTypeA
WriteFile
CloseHandle
CreateFileA
IsDBCSLeadByte
GetVersionExA
GetFileAttributesA
FreeLibrary
GetProcAddress
GetLastError
LoadLibraryA
GetShortPathNameW
LoadLibraryW
LocalFree
GetCurrentProcess
Sleep
CreateDirectoryA
GetFileTime
ReadFile
SetFilePointer
GetFullPathNameA
InterlockedExchange
GetSystemTimeAsFileTime
user32
CharPrevA
CharNextA
ole32
CoUninitialize
CoInitialize
CoGetClassObject
advapi32
ImpersonateSelf
RegQueryValueExA
RegOpenKeyExA
RevertToSelf
SetNamedSecurityInfoA
InitializeAcl
GetNamedSecurityInfoA
RegCloseKey
OpenThreadToken
OpenProcessToken
MapGenericMask
AccessCheck
shlwapi
StrChrA
Exports
Exports
??0CCollection@@QAE@XZ
??0CFIFOString@@QAE@XZ
??0CFolder@@QAE@XZ
??0CLocation@@QAE@XZ
??0CPointerList@@QAE@XZ
??0CTitle@@QAE@XZ
??1CCollection@@QAE@XZ
??1CFIFOString@@QAE@XZ
??1CFolder@@QAE@XZ
??1CLocation@@QAE@XZ
??1CPointerList@@QAE@XZ
??1CTitle@@QAE@XZ
??4CCollection@@QAEAAV0@ABV0@@Z
??4CFIFOString@@QAEAAV0@ABV0@@Z
??4CFolder@@QAEAAV0@ABV0@@Z
??4CLocation@@QAEAAV0@ABV0@@Z
??4CPointerList@@QAEAAV0@ABV0@@Z
??4CTitle@@QAEAAV0@ABV0@@Z
?Add@CPointerList@@QAEPAUListItem@@PAX@Z
?AddChildFolder@CFolder@@QAEKPAV1@@Z
?AddChildFolder@CFolder@@QAEPAV1@PBDKPAKG@Z
?AddChildFolder@CFolder@@QAEPAV1@PBGKPAKG@Z
?AddCollection@CCollection@@QAEPAVCColList@@XZ
?AddFolder@CCollection@@QAEPAVCFolder@@PBDKPAKG@Z
?AddFolder@CCollection@@QAEPAVCFolder@@PBGKPAKG@Z
?AddLocation@CCollection@@QAEPAVCLocation@@PBD000PAK@Z
?AddLocation@CCollection@@QAEPAVCLocation@@PBG000PAK@Z
?AddLocationHistory@CTitle@@QAEKKPBD00PBVCLocation@@00H@Z
?AddLocationHistory@CTitle@@QAEKKPBG00PBVCLocation@@00H@Z
?AddRef@CCollection@@QAEXXZ
?AddRefedTitle@CCollection@@AAEKPAVCFolder@@@Z
?AddTail@CFIFOString@@QAEKPAD@Z
?AddTitle@CCollection@@QAEPAVCTitle@@PBD0000GIPAVCLocation@@PAKH0@Z
?AddTitle@CCollection@@QAEPAVCTitle@@PBG0000GIPAVCLocation@@PAKH0@Z
?AllocCopyValue@CCollection@@AAEKPAVCParseXML@@PADPAPAD@Z
?AllocSetValue@@YGKPBDPAPAD@Z
?CheckTitleRef@CCollection@@AAEKPBDG@Z
?CheckTitleRef@CCollection@@AAEKPBGG@Z
?Close@CCollection@@QAEKXZ
?ConfirmTitles@CCollection@@QAEXXZ
?DecrementRefTitleCount@CCollection@@QAEXXZ
?DeleteChildren@CCollection@@AAEXPAPAVCFolder@@@Z
?DeleteFolder@CCollection@@QAEKPAVCFolder@@@Z
?DeleteFolders@CCollection@@AAEXPAPAVCFolder@@@Z
?DeleteLocalFiles@CCollection@@AAEXPAULocationHistory@@PAVCTitle@@@Z
?DeleteLocation@CCollection@@AAEKPAVCLocation@@@Z
?DeleteTitle@CCollection@@AAEKPAVCTitle@@@Z
?Dirty@CCollection@@QAEXXZ
?FindCollection@CCollection@@QAEPAVCColList@@PBD@Z
?FindLocation@CCollection@@QAEPAVCLocation@@PBDPAI@Z
?FindLocation@CCollection@@QAEPAVCLocation@@PBGPAI@Z
?FindTitle@CCollection@@QAEPAVCTitle@@PBDG@Z
?FindTitle@CCollection@@QAEPAVCTitle@@PBGG@Z
?First@CPointerList@@QAEPAUListItem@@XZ
?FirstLocation@CCollection@@QAEPAVCLocation@@XZ
?GetColNo@CCollection@@QAEKXZ
?GetCollectionFileName@CCollection@@QAEPBDXZ
?GetCollectionFileNameW@CCollection@@QAEPBGXZ
?GetFindMergedCHMS@CCollection@@QAEHXZ
?GetFirstChildFolder@CFolder@@QAEPAV1@XZ
?GetFirstTitle@CCollection@@QAEPAVCTitle@@XZ
?GetId@CLocation@@QBEPADXZ
?GetId@CTitle@@QAEPADXZ
?GetIdW@CLocation@@QAEPBGXZ
?GetIdW@CTitle@@QAEPBGXZ
?GetLangId@CCollection@@QAEGPBD@Z
?GetLangId@CCollection@@QAEGPBG@Z
?GetLanguage@CFolder@@QAEGXZ
?GetLanguage@CTitle@@QAEGXZ
?GetLocation@CTitle@@QAEPAULocationHistory@@K@Z
?GetMasterCHM@CCollection@@QAEHPAPADPAG@Z
?GetMasterCHM@CCollection@@QAEHPAPAGPAG@Z
?GetNextFolder@CFolder@@QAEPAV1@XZ
?GetNextLocation@CLocation@@QAEPAV1@XZ
?GetNextTitle@CTitle@@QAEPAV1@XZ
?GetOrder@CFolder@@QAEKXZ
?GetParent@CFolder@@QAEPAV1@XZ
?GetPath@CLocation@@QAEPADXZ
?GetPathW@CLocation@@QAEPBGXZ
?GetRefTitleCount@CCollection@@QAEKXZ
?GetRootFolder@CCollection@@QAEPAVCFolder@@XZ
?GetSampleLocation@CCollection@@QAEPADXZ
?GetSampleLocationW@CCollection@@QAEPBGXZ
?GetTail@CFIFOString@@QAEKPAPAD@Z
?GetTitle@CFolder@@QAEPADXZ
?GetTitle@CLocation@@QAEPADXZ
?GetTitleW@CFolder@@QAEPBGXZ
?GetTitleW@CLocation@@QAEPBGXZ
?GetVersion@CCollection@@QAEKXZ
?GetVisableRootFolder@CCollection@@QAEPAVCFolder@@XZ
?GetVolume@CLocation@@QAEPADXZ
?GetVolumeW@CLocation@@QAEPBGXZ
?HandleCollection@CCollection@@AAEKPAVCParseXML@@PAD@Z
?HandleCollectionEntry@CCollection@@AAEKPAVCParseXML@@PAD@Z
?HandleFolder@CCollection@@AAEKPAVCParseXML@@PAD@Z
?HandleLocation@CCollection@@AAEKPAVCParseXML@@PAD@Z
?HandleTitle@CCollection@@AAEKPAVCParseXML@@PAD@Z
?IncrementRefTitleCount@CCollection@@QAEXXZ
?IsDirty@CCollection@@QAEHXZ
?MergeKeywords@CCollection@@QAEHPAD@Z
?MergeKeywords@CCollection@@QAEHPAG@Z
?NewLocation@CCollection@@AAEPAVCLocation@@XZ
?NewLocationHistory@CTitle@@QAEPAULocationHistory@@XZ
?NewTitle@CCollection@@AAEPAVCTitle@@XZ
?Next@CPointerList@@QAEPAUListItem@@PAU2@@Z
?Open@CCollection@@QAEKPBD@Z
?Open@CCollection@@QAEKPBG@Z
?ParseFile@CCollection@@AAEKPBD@Z
?Release@CCollection@@AAEKXZ
?RemoveAll@CFIFOString@@QAEXXZ
?RemoveAll@CPointerList@@QAEXXZ
?RemoveCollection@CCollection@@QAEKH@Z
?RemoveCollectionEntry@CCollection@@QAEXPBD@Z
?Save@CCollection@@QAEKXZ
?SetExTitlePtr@CFolder@@QAEXPAVCExTitle@@@Z
?SetFindMergedCHMS@CCollection@@QAEXH@Z
?SetFirstChildFolder@CFolder@@QAEXPAV1@@Z
?SetId@CLocation@@QAEXPBD@Z
?SetId@CLocation@@QAEXPBG@Z
?SetId@CTitle@@QAEXPBD@Z
?SetId@CTitle@@QAEXPBG@Z
?SetLanguage@CFolder@@QAEXG@Z
?SetLanguage@CTitle@@QAEXG@Z
?SetMasterCHM@CCollection@@QAEXPBDG@Z
?SetMasterCHM@CCollection@@QAEXPBGG@Z
?SetNextFolder@CFolder@@QAEXPAV1@@Z
?SetNextLocation@CLocation@@QAEXPAV1@@Z
?SetNextTitle@CTitle@@QAEXPAV1@@Z
?SetOrder@CFolder@@QAEXK@Z
?SetParent@CFolder@@QAEXPAV1@@Z
?SetPath@CLocation@@QAEXPBD@Z
?SetPath@CLocation@@QAEXPBG@Z
?SetSampleLocation@CCollection@@QAEXPBD@Z
?SetSampleLocation@CCollection@@QAEXPBG@Z
?SetTitle@CFolder@@QAEXPBD@Z
?SetTitle@CFolder@@QAEXPBG@Z
?SetTitle@CLocation@@QAEXPBD@Z
?SetTitle@CLocation@@QAEXPBG@Z
?SetVersion@CCollection@@QAEXK@Z
?SetVolume@CLocation@@QAEXPBD@Z
?SetVolume@CLocation@@QAEXPBG@Z
?WriteFolder@CCollection@@AAEHPAPAVCFolder@@@Z
?WriteFolders@CCollection@@AAEHPAPAVCFolder@@@Z
?bIsVisable@CFolder@@QAEHXZ
?wssResetNextColNum@CCollection@@AAEXXZ
Sections
.text Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ