d:\Ideacts Work\Work\Dev\CLINCK\Source\Dev-CLINCK\Clinck\BIN\ClinckSupport.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3251f3bf39a5db1899f361c745869971_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3251f3bf39a5db1899f361c745869971_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3251f3bf39a5db1899f361c745869971_JaffaCakes118
-
Size
192KB
-
MD5
3251f3bf39a5db1899f361c745869971
-
SHA1
3cb349f93b588e1e29012535c193114ae7d5b468
-
SHA256
8cf89550c37c2f9af587403a871185ea25cb7b4068639fe3325526da5685053e
-
SHA512
aaad880f1862e8a6a80afcfbd0fc362fb26cd26c455e77813050e565be20f4e10075d8ae08ac133f987e611eac0ede1d88ec4a3dfa848f224a476d11c7219450
-
SSDEEP
3072:ecxfeMmxBpnNOBHeS0hvREVdlLofV5BjA1TDEMuKYc2ACDF:fxCOB+udlLa5BjAsMu0CB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3251f3bf39a5db1899f361c745869971_JaffaCakes118
Files
-
3251f3bf39a5db1899f361c745869971_JaffaCakes118.exe windows:4 windows x86 arch:x86
33c0e97ae722d3e7f983d156307bd5f8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
terminalsetting
UninstallTerminalSettings
clinckutilities
?SetStringValue@CRegistryKey@@QBEHPBD0@Z
?ShowAlert@CommonUtil@@SAXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
??0CClinckWebClient@@QAE@XZ
??1CClinckWebClient@@UAE@XZ
?CreateTerminal@CClinckWebClient@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@00@Z
?GetLastServerResponse@CClinckWebClient@@QAEPAVCClinckWebResponse@@XZ
?IsValidClinckResponse@CClinckWebResponse@@QAEHXZ
?GetValue@CClinckWebResponse@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@V23@@Z
??0ClinckDataString@@QAE@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@W4ClinckDataCategory@@@Z
??1ClinckDataString@@UAE@XZ
?Set@ClinckDataString@@UBEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetCafeDetails@CClinckWebClient@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0@Z
?CheckIfAdminUser@CClinckProcess@@SAHXZ
??0CClinckCommandLineInfo@@QAE@XZ
??1CClinckCommandLineInfo@@UAE@XZ
??0CFSUtil@@QAE@XZ
??1CFSUtil@@UAE@XZ
?CheckDeepFreezeInstalled@CClinckSetting@@SAHXZ
??0CDataTrackingManager@@QAE@PAVCWinApp@@@Z
??1CDataTrackingManager@@QAE@XZ
??0DeepFreezeInfo@@QAE@XZ
??1DeepFreezeInfo@@QAE@XZ
?GetSpecialDirectoryPath@CFSUtil@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?Get@ClinckDataString@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?m_bFlagUnableLoging@CClinckLog@@2HA
?PrintTime@@YAXAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetValue@CRegistry@@QAE_NW4Keys@1@PBD11@Z
??0CClinckProcess@@QAE@XZ
??1CClinckProcess@@UAE@XZ
?GetValue@CRegistry@@QAE_NW4Keys@1@PBD1AAK@Z
?GetValue@CRegistry@@QAE_NW4Keys@1@PBD1AAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?InitiateAdminUser@CClinckProcess@@QAEHXZ
?SetValue@CRegistry@@QAE_NW4Keys@1@PBD1K@Z
?TerminateAdminUser@CClinckProcess@@QAEHXZ
?CheckLogSize@CClinckSytem@@SAXXZ
??0CLimitSingleInstance@@QAE@PBD@Z
?WriteLog@CClinckSytem@@SAXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?IsAnotherInstanceRunning@CLimitSingleInstance@@QAEHXZ
?IsAfterInstallSession@CClinckCommandLineInfo@@QAEHXZ
?IsUnInstallSession@CClinckCommandLineInfo@@QAEHXZ
?IsStartClinckOnly@CClinckCommandLineInfo@@QAEHXZ
??1CLimitSingleInstance@@UAE@XZ
?IsStartCCM@CClinckCommandLineInfo@@QAEHXZ
?KillClinckProcess@CClinckProcess@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetIntegerValue@CRegistryKey@@QBEHPBDK@Z
??1CRegistryKey@@QAE@XZ
?GetDFStatus@DeepFreezeInfo@@SAHXZ
?GetDFVersionNumber@DeepFreezeInfo@@SAHXZ
?DisplayError@CommonUtil@@SAXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetApplicationLocation@CClinckSetting@@SA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?CheckIfFileExists@CFSUtil@@QAEHPBD@Z
??0CClinckProcess@@QAE@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?AddParam@CClinckProcess@@QAEXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0@Z
?StartProcessInUserMode@CClinckProcess@@QAEHH@Z
?StartProcessInAdminMode@CClinckProcess@@QAEHH@Z
?LogError@CClinckErrorManager@@SAXUClinckError@@@Z
??0ClinckError@@QAE@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0K@Z
?AddParam@CClinckProcess@@QAEXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?IsOpened@CRegistryKey@@QAEHXZ
?GetUpdateInformation@CClinckWebClient@@QAEHXZ
?bShowVerboseMessage@CommonUtil@@2HA
?GetStringValue@CRegistryKey@@QBE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
??0CExtractUpdate@@QAE@XZ
??1CExtractUpdate@@QAE@XZ
?ExtractUpdate@CExtractUpdate@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0@Z
??0CPowerSettings@@QAE@XZ
??1CPowerSettings@@QAE@XZ
?ApplyPowerSettings@CPowerSettings@@QAEHUtagPOWERSETTINGS@@H@Z
?RemoveClinckToFirewallList@@YAXXZ
??0CSystemAccessUtil@@QAE@XZ
??0CRegistryKey@@QAE@PAUHKEY__@@PBDHK@Z
?NotifyTerminalUninstall@CClinckWebClient@@QAEHXZ
?SetBrowserStartupPage@CSystemAccessUtil@@QAEHH@Z
?HideQuickLaunchBar@CSystemAccessUtil@@QAEXH@Z
?SendShutdownClinckMessage@CClinckProcess@@QAEXXZ
?GetIntegerValue@CRegistryKey@@QBE_NPBDAAK@Z
??0ClinckDataInteger@@QAE@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
??1ClinckDataInteger@@UAE@XZ
??0CIni@@QAE@PBD@Z
??1CIni@@UAE@XZ
?GetString@CIni@@QBE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD00@Z
?CheckPath@CFSUtil@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?CanDelete@CFSUtil@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?Delete@CFSUtil@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?FileDelete@CFSUtil@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SendEWSMessage@CClinckWebClient@@QAEHUClinckError@@@Z
?IsSectionExist@CIni@@QBEHPBD@Z
?GetKeyNames@CIni@@QBEXPBDPAVCStringArray@@@Z
?WriteString@CIni@@QBEHPBD00@Z
?Set@ClinckDataInteger@@UBEHH@Z
?DeleteSubKey@CRegistryKey@@QAEHPBD@Z
?GetValueForKey@CRegistryKey@@QAEHKPADPAK1PAE1@Z
??0ClinckError@@QAE@ABU0@@Z
??1ClinckError@@QAE@XZ
??1CRegistry@@QAE@XZ
?GetOSVersion@CommonUtil@@SA?AW4OSVERSION@@XZ
?IsActivationOnly@CClinckCommandLineInfo@@QAEHXZ
??1CSystemAccessUtil@@UAE@XZ
mfc80
ord2468
ord5403
ord1903
ord3182
ord4262
ord4486
ord3949
ord2644
ord3709
ord3719
ord3718
ord2533
ord2646
ord2540
ord2862
ord2714
ord4307
ord2835
ord2731
ord2537
ord5200
ord1599
ord1655
ord1656
ord1964
ord1024
ord1362
ord4967
ord3345
ord6277
ord3802
ord6279
ord1522
ord2172
ord2178
ord2405
ord2387
ord2385
ord2403
ord2415
ord2392
ord2408
ord2413
ord2396
ord2398
ord2400
ord2394
ord2410
ord2390
ord934
ord930
ord932
ord928
ord923
ord5233
ord5235
ord5960
ord1600
ord4282
ord4722
ord3403
ord5203
ord784
ord6275
ord5073
ord1908
ord5152
ord4244
ord1401
ord3946
ord1617
ord1620
ord5912
ord6724
ord1551
ord1670
ord1671
ord2020
ord4890
ord4212
ord5182
ord6703
ord299
ord1489
ord5491
ord1486
ord762
ord265
ord266
ord4541
ord3683
ord566
ord757
ord5119
ord380
ord5493
ord2703
ord2702
ord3201
ord3389
ord6013
ord556
ord744
ord5097
ord6310
ord1452
ord3830
ord1054
ord2131
ord557
ord745
ord5715
ord1185
ord3333
ord4481
ord2838
ord5566
ord5213
ord5230
ord4568
ord3948
ord2248
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord6174
ord6180
ord5490
ord1482
ord911
ord2451
ord1247
ord3441
ord2095
ord1591
ord4240
ord3317
ord741
ord4735
ord2322
ord5833
ord6067
ord2657
ord6236
ord4749
ord709
ord501
ord2654
ord5731
ord2164
ord1280
ord4580
ord3204
ord3210
ord1934
ord2371
ord2658
ord3641
ord1794
ord1774
ord1892
ord1084
ord1063
ord620
ord572
ord3195
ord4261
ord2991
ord5214
ord1402
ord5915
ord6725
ord587
ord3164
ord4232
ord1545
ord2086
ord3163
ord605
ord354
ord781
ord310
ord297
ord578
ord304
ord764
ord1207
ord5175
ord4185
msvcr80
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_setmbcp
_unlock
__CxxFrameHandler3
atol
memset
_controlfp_s
kernel32
WaitForSingleObject
FreeLibraryAndExitThread
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
ResumeThread
GetLastError
FindClose
lstrcmpA
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCurrentProcess
lstrcpyA
lstrcatA
GetFileAttributesA
SetFileAttributesA
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
FindFirstFileA
Sleep
FindNextFileA
user32
ExitWindowsEx
FindWindowA
EnableWindow
MessageBoxA
DrawIcon
GetClientRect
IsIconic
SendMessageA
ModifyMenuA
GetSystemMenu
LoadIconA
PostMessageA
SetTimer
GetSysColor
GetSystemMetrics
gdi32
CreateFontA
CreateSolidBrush
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
comctl32
InitCommonControlsEx
shlwapi
PathAddBackslashA
PathRemoveFileSpecA
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE