O:\OOO330\ooo\filter\wntmsci12.pro\bin\idxmi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2d315637102e46250fb2ec4d9c9bd769_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2d315637102e46250fb2ec4d9c9bd769_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2d315637102e46250fb2ec4d9c9bd769_JaffaCakes118
-
Size
60KB
-
MD5
2d315637102e46250fb2ec4d9c9bd769
-
SHA1
8e0fae922e3db69a93df7d90cdfb0f13c4226690
-
SHA256
6fd33ffb800167cc08775cab0de796c1ccecc117536ce7bbe5755d889a2b8bb4
-
SHA512
e212335539064b97642e583b5dd1a1f8b502e836e5c95bf2376f74a9031a8905701127176cdbe5c0b0f9555531bcb09e32a599b01f1863afc853544bc239467c
-
SSDEEP
768:m2nrHnXr5ioNPYFZXVfw0OyP/JPZAD4ssZyrybLLA6guUSVFxQfruCft5ciUBTPB:mL0+1Vf3NBA1nrbeOzuGPciUdpGOGG8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d315637102e46250fb2ec4d9c9bd769_JaffaCakes118
Files
-
2d315637102e46250fb2ec4d9c9bd769_JaffaCakes118.dll windows:5 windows x86 arch:x86
d44b6302548b453d61636f8ba13a341c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
vclmi
?SetStyle@LineInfo@@QAEXW4LineStyle@@@Z
?SetWidth@LineInfo@@QAEXJ@Z
?SetDashCount@LineInfo@@QAEXG@Z
?SetDashLen@LineInfo@@QAEXJ@Z
?SetDotCount@LineInfo@@QAEXG@Z
?SetDotLen@LineInfo@@QAEXJ@Z
?SetDistance@LineInfo@@QAEXJ@Z
??1VirtualDevice@@UAE@XZ
?SetRelativeMapMode@OutputDevice@@UAEXABVMapMode@@@Z
?SetMapMode@OutputDevice@@UAEXXZ
?SetMapMode@OutputDevice@@UAEXABVMapMode@@@Z
?SetSettings@OutputDevice@@UAEXABVAllSettings@@@Z
??0VirtualDevice@@QAE@G@Z
?EnableOutput@OutputDevice@@QAEXE@Z
?Record@GDIMetaFile@@QAEXPAVOutputDevice@@@Z
?Stop@GDIMetaFile@@QAEXXZ
??0MapMode@@QAE@W4MapUnit@@@Z
??4MapMode@@QAEAAV0@ABV0@@Z
??1MapMode@@QAE@XZ
?DrawPolyPolygon@OutputDevice@@QAEXABVPolyPolygon@@@Z
?DrawText@OutputDevice@@QAEXABVPoint@@ABVString@@GGPAV?$vector@VRectangle@@V?$allocator@VRectangle@@@_STL@@@_STL@@PAV3@@Z
?DrawPolygon@OutputDevice@@QAEXABVPolygon@@@Z
?DrawArc@OutputDevice@@QAEXABVRectangle@@ABVPoint@@1@Z
?DrawEllipse@OutputDevice@@QAEXABVRectangle@@@Z
?DrawPolyLine@OutputDevice@@QAEXABVPolygon@@@Z
?DrawPixel@OutputDevice@@QAEXABVPoint@@@Z
??0LineInfo@@QAE@W4LineStyle@@J@Z
??4LineInfo@@QAEAAV0@ABV0@@Z
??1LineInfo@@QAE@XZ
?DrawLine@OutputDevice@@QAEXABVPoint@@0ABVLineInfo@@@Z
?DrawLine@OutputDevice@@QAEXABVPoint@@0@Z
??0Font@@QAE@XZ
??1Font@@QAE@XZ
?SetColor@Font@@QAEXABVColor@@@Z
?SetTransparent@Font@@QAEXE@Z
?SetFamily@Font@@QAEXW4FontFamily@@@Z
?SetSize@Font@@QAEXABVSize@@@Z
?SetAlign@Font@@QAEXW4TextAlign@@@Z
?SetOrientation@Font@@QAEXF@Z
??8Font@@QBEEABV0@@Z
??4Font@@QAEAAV0@ABV0@@Z
?SetFont@OutputDevice@@QAEXABVFont@@@Z
?SetLineColor@OutputDevice@@QAEXABVColor@@@Z
?SetFillColor@OutputDevice@@QAEXABVColor@@@Z
??0GDIMetaFile@@QAE@XZ
??1GDIMetaFile@@UAE@XZ
??0Graphic@@QAE@ABVGDIMetaFile@@@Z
??4Graphic@@QAEAAV0@ABV0@@Z
??1Graphic@@UAE@XZ
tlmi
??0Polygon@@QAE@G@Z
??1ByteString@@QAE@XZ
??1String@@QAE@XZ
??0String@@QAE@ABVByteString@@GK@Z
??0ByteString@@QAE@PBD@Z
??1PolyPolygon@@QAE@XZ
?Count@PolyPolygon@@QBEGXZ
??APolygon@@QAEAAVPoint@@G@Z
??0PolyPolygon@@QAE@GG@Z
?Seek@SvStream@@QAEKK@Z
?Append@ByteString@@QAEAAV1@D@Z
?Read@SvStream@@QAEKPAXK@Z
?GetError@SvStream@@QBEKXZ
?Erase@ByteString@@QAEAAV1@GG@Z
??0ByteString@@QAE@XZ
??1Polygon@@QAE@XZ
?Insert@PolyPolygon@@QAEXABVPolygon@@G@Z
msvcr90
memmove
free
_CIsin
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
__CxxFrameHandler3
_malloc_crt
_encode_pointer
atof
memcpy
_CIatan2
_CIsqrt
strncpy
??_U@YAPAXI@Z
??_V@YAXPAX@Z
??2@YAPAXI@Z
??3@YAXPAX@Z
_CxxThrowException
_CIcos
kernel32
GetSystemTimeAsFileTime
Sleep
InterlockedCompareExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedExchange
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
stlport_vc7145
?allocate@?$__node_alloc@$00$0A@@_STL@@SAPAXI@Z
?deallocate@?$__node_alloc@$00$0A@@_STL@@SAXPAXI@Z
Exports
Exports
GetVersionInfo
GraphicImport
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ