C:\BUILD_AREA\jdk6\control\build\windows-i586\tmp\deploy\common\bin\deploy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3265642e20ffe4db8eca1d1dcc8479fd_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3265642e20ffe4db8eca1d1dcc8479fd_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3265642e20ffe4db8eca1d1dcc8479fd_JaffaCakes118
-
Size
132KB
-
MD5
3265642e20ffe4db8eca1d1dcc8479fd
-
SHA1
546f268275ca2dee71812b9e2e69e54186227985
-
SHA256
6497761b8a7266f39c844ff9b8de1c351488c29017cfc6bb56e1eb747e3ee4bb
-
SHA512
24fbc0bee30197db8864c6d9cabe9357b2e153099b693b6a4378dd299e140df6675072a7db926a094c322b7778bd99765ec5818e74331fcff85bd32b111dee02
-
SSDEEP
3072:aTfTS1PzRAUStDWvpkTF65aJfbIAuTfK0:H9zRBsDcpDKIXp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3265642e20ffe4db8eca1d1dcc8479fd_JaffaCakes118
Files
-
3265642e20ffe4db8eca1d1dcc8479fd_JaffaCakes118.dll windows:4 windows x86 arch:x86
20f88b49f1405c32758fa2aff7d83bf1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
crypt32
CryptAcquireCertificatePrivateKey
CertGetPublicKeyLength
CertFreeCertificateChain
CertOpenSystemStoreA
CertEnumCertificatesInStore
CertCloseStore
CertGetCertificateChain
CertGetEnhancedKeyUsage
kernel32
InterlockedDecrement
lstrlenW
GetLastError
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
FormatMessageA
ExpandEnvironmentStringsA
SystemTimeToFileTime
GetSystemTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
InterlockedIncrement
DisableThreadLibraryCalls
GetModuleFileNameA
GetCurrentProcess
CloseHandle
GetTempPathA
GetCurrentProcessId
GetSystemDirectoryA
GetWindowsDirectoryA
WideCharToMultiByte
LocalFree
FreeLibrary
lstrlenA
GetModuleHandleA
LoadLibraryA
GetProcAddress
RaiseException
MultiByteToWideChar
user32
GetWindowLongA
GetForegroundWindow
wsprintfA
CharNextA
MessageBoxA
wsprintfW
ExitWindowsEx
GetWindowThreadProcessId
advapi32
CryptGetUserKey
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegFlushKey
CryptCreateHash
CryptSetHashParam
CryptSignHashA
CryptDestroyHash
CryptDestroyKey
RegQueryValueExA
CryptSetKeyParam
CryptGetKeyParam
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetUserNameW
shell32
ShellExecuteA
FindExecutableA
ole32
CoTaskMemFree
CLSIDFromProgID
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
VariantInit
VariantClear
VarUI4FromStr
SysFreeString
wininet
HttpSendRequestA
InternetQueryOptionA
InternetGoOnline
InternetSetOptionA
InternetGetCookieA
InternetSetCookieA
InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetCloseHandle
urlmon
FindMimeFromData
msvcr71
wcscmp
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
_local_unwind2
strstr
realloc
??_U@YAPAXI@Z
_resetstkoflw
_dup
_dup2
_lseek
_tempnam
calloc
__security_error_handler
memset
strtok
fopen
fputs
fclose
remove
malloc
_open
_fstat
_read
_close
_stricmp
_strdup
??_V@YAXPAX@Z
free
wcslen
_except_handler3
?terminate@@YAXXZ
__CppXcptFilter
_purecall
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler
??2@YAPAXI@Z
strncpy
_adjust_fdiv
Exports
Exports
??0BasicPerfHelper@@QAE@ABV0@@Z
??0BasicPerfHelper@@QAE@ABVSystemTime@@AAVNativeLock@@@Z
??0BasicPerfStore@@QAE@ABV0@@Z
??0BasicPerfStore@@QAE@ABVSystemTime@@AAVNativeLock@@@Z
??0DeployPerf@@QAE@ABV0@@Z
??0DeployPerf@@QAE@XZ
??0NativeLock@@IAE@XZ
??0NativeLocker@@QAE@PAVNativeLock@@@Z
??0PerfHelper@@QAE@ABV0@@Z
??0PerfHelper@@QAE@XZ
??0PerfLabel@@QAE@ABV0@@Z
??0PerfLabel@@QAE@XZ
??0PerfLabel@@QAE@_JPBD@Z
??0PerfStore@@QAE@ABV0@@Z
??0PerfStore@@QAE@XZ
??0SystemTime@@QAE@ABV0@@Z
??0SystemTime@@QAE@XZ
??0WinLock@@QAE@XZ
??0WinTime@@QAE@ABV0@@Z
??0WinTime@@QAE@XZ
??1BasicPerfHelper@@UAE@XZ
??1BasicPerfStore@@UAE@XZ
??1DeployPerf@@UAE@XZ
??1NativeLock@@MAE@XZ
??1NativeLocker@@QAE@XZ
??1PerfHelper@@UAE@XZ
??1PerfStore@@UAE@XZ
??1SystemTime@@UAE@XZ
??1WinLock@@UAE@XZ
??1WinTime@@UAE@XZ
??4DeployPerf@@QAEAAV0@ABV0@@Z
??4NativeLocker@@QAEAAV0@ABV0@@Z
??4PerfHelper@@QAEAAV0@ABV0@@Z
??4PerfLabel@@QAEAAV0@ABV0@@Z
??4PerfStore@@QAEAAV0@ABV0@@Z
??4SystemTime@@QAEAAV0@ABV0@@Z
??4WinTime@@QAEAAV0@ABV0@@Z
??_7BasicPerfHelper@@6B@
??_7BasicPerfStore@@6B@
??_7DeployPerf@@6B@
??_7NativeLock@@6B@
??_7PerfHelper@@6B@
??_7PerfStore@@6B@
??_7SystemTime@@6B@
??_7WinLock@@6B@
??_7WinTime@@6B@
?LABEL_BUFFER_SIZE@PerfLabel@@2IB
?MAX_LABEL_COUNT@BasicPerfStore@@0IB
?_get@BasicPerfStore@@ABE?AVPerfLabel@@I@Z
?acquire@WinLock@@UAEXXZ
?calculateJavaEpoch@WinTime@@CA_JXZ
?get@BasicPerfStore@@UBE?AVPerfLabel@@I@Z
?getCurrentTime@BasicPerfHelper@@UBE_JXZ
?getCurrentTime@WinTime@@UBE_JXZ
?getJavaObj@PerfLabel@@QBEPAV_jobject@@PAUJNIEnv_@@@Z
?initStore@BasicPerfHelper@@UAE_NXZ
?labelToString@PerfLabel@@QBEPAV_jstring@@PAUJNIEnv_@@@Z
?put@BasicPerfHelper@@UAEXPAUJNIEnv_@@PAV_jstring@@@Z
?put@BasicPerfHelper@@UAEXPBD@Z
?put@BasicPerfStore@@QAEXPAUJNIEnv_@@PAV_jstring@@@Z
?put@BasicPerfStore@@UAEXPBD@Z
?put@PerfHelper@@MAEXPAUJNIEnv_@@PAV_jstring@@@Z
?release@WinLock@@UAEXXZ
?size@BasicPerfStore@@UBEIXZ
?toArray@BasicPerfHelper@@UBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
?toArray@BasicPerfStore@@QBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
?toArray@PerfHelper@@MBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
GetDeployPerf
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_ExpandEnvironmentStrings@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_FindMimeFromData@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegCloseKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegCreateKeyEx@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegDeleteKey@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegDeleteValue@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegEnumKeyEx@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegEnumValue@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegFlushKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegOpenKey@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegQueryInfoKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegQueryValueEx@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegSetValueEx@20
_Java_com_sun_deploy_config_WinConfig_addRemoveProgramsAdd@36
_Java_com_sun_deploy_config_WinConfig_addRemoveProgramsRemove@16
_Java_com_sun_deploy_config_WinConfig_canDownloadJRE@8
_Java_com_sun_deploy_config_WinConfig_getBrowserPath@8
_Java_com_sun_deploy_config_WinConfig_getPlatformSystemHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_getPlatformUserHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_getSystemExecutableHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_installShortcut@36
_Java_com_sun_deploy_config_WinConfig_isBrowserFireFox@8
_Java_com_sun_deploy_config_WinConfig_isNativeModalDialogUp@8
_Java_com_sun_deploy_config_WinConfig_isPlatformWindowsVista@8
_Java_com_sun_deploy_config_WinConfig_notifyJREInstalled@12
_Java_com_sun_deploy_config_WinConfig_showDocument@12
_Java_com_sun_deploy_net_cookie_IExplorerCookieHandler_getCookieInfo@12
_Java_com_sun_deploy_net_cookie_IExplorerCookieHandler_setCookieInfo@16
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_askUserGoOnline@12
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_isGlobalOffline@8
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_setGlobalOffline@12
_Java_com_sun_deploy_net_proxy_WIExplorerAutoProxyHandler_evalScript@12
_Java_com_sun_deploy_net_proxy_WIExplorerProxyConfig_getBrowserProxySettings@8
_Java_com_sun_deploy_net_proxy_WIExplorerProxyConfig_performAutoDetection@8
_Java_com_sun_deploy_perf_NativePerfHelper_put@12
_Java_com_sun_deploy_perf_NativePerfHelper_toArray@8
_Java_com_sun_deploy_security_MSCredentialManager_decryptMSPassword@12
_Java_com_sun_deploy_security_MSCredentialManager_encryptMSPassword@12
_Java_com_sun_deploy_security_MSCredentialManager_getLoginUID@8
_Java_com_sun_deploy_security_MSCredentialManager_isEncryptionAvailable@8
_Java_com_sun_deploy_security_MSCryptoDSASignature_nativeSignHash@24
_Java_com_sun_deploy_security_MSCryptoNONEwithRSASignature_nativeSignHash@24
_Java_com_sun_deploy_security_MSCryptoRSAKey_cleanUp@16
_Java_com_sun_deploy_security_WIExplorerBrowserAuthenticator14_getAuthentication@12
_Java_com_sun_deploy_security_WIExplorerBrowserAuthenticator_getAuthFromInet@28
_Java_com_sun_deploy_security_WIExplorerCertStore_loadCertificates@20
_Java_com_sun_deploy_security_WIExplorerMyKeyStore_loadKeysAndCertificateChains@16
_Java_com_sun_deploy_security_WSeedGenerator_generateSeed@12
_Java_com_sun_deploy_util_ConsoleHelper_dumpAllStacksImpl@8
_Java_com_sun_deploy_util_ConsoleHelper_preMustangDumpAllStacksImpl@8
_Java_com_sun_deploy_util_WinRegistry_getWindowsDirectory@8
_Java_com_sun_deploy_util_WinRegistry_initIDs@8
_Java_com_sun_deploy_util_WinRegistry_sysCloseKey@12
_Java_com_sun_deploy_util_WinRegistry_sysCreateKey@20
_Java_com_sun_deploy_util_WinRegistry_sysDeleteKey@16
_Java_com_sun_deploy_util_WinRegistry_sysOpenKey@20
_Java_com_sun_deploy_util_WinRegistry_sysQueryKey@16
_Java_com_sun_deploy_util_WinRegistry_sysReboot@8
_Java_com_sun_deploy_util_WinRegistry_sysSetStringValue@20
Sections
.text Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 808B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE