I:\ygDxdtFmtk\tqeUnnuVuiq\vaVnpwRjqBjF\cMpjaesfcorn\lgfoXiGpmd.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2f1f9194c261a62d0dd66d36fd994457_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2f1f9194c261a62d0dd66d36fd994457_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2f1f9194c261a62d0dd66d36fd994457_JaffaCakes118
-
Size
105KB
-
MD5
2f1f9194c261a62d0dd66d36fd994457
-
SHA1
f971788c3870418c14fb112b7225199c756df31b
-
SHA256
7cb15e70aab6f0367f79d00a219da5d2e7b6dbefed21f3bffde042f2875adc9b
-
SHA512
91b912a57c43a4c05060db20b753b4829181fb3258df4e533f42763e42cbbf8bfb4c5201b98b6b06ad4ca3702b9a0b0ceffbc9cb95bbf933e7eeb3211f246f20
-
SSDEEP
1536:XsYRZ0bfW8CRNNRi236p5Jf9Spl9+W2shSoiqMZfPBusaLe2p:XsA7vRNNRi2325Jfs+whSokG/hp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f1f9194c261a62d0dd66d36fd994457_JaffaCakes118
Files
-
2f1f9194c261a62d0dd66d36fd994457_JaffaCakes118.dll windows:5 windows x86 arch:x86
6d18ce1e3c365a81cc16bcb2122fa7d6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
comdlg32
CommDlgExtendedError
GetOpenFileNameA
user32
DrawFocusRect
ScrollWindowEx
GetDCEx
RegisterClassW
GetScrollInfo
OpenInputDesktop
SetWindowLongW
InSendMessageEx
ClipCursor
SetLastErrorEx
AttachThreadInput
FrameRect
SetMenu
GetClassLongW
SendDlgItemMessageA
GetAsyncKeyState
GetSysColorBrush
SetWindowPlacement
DeferWindowPos
LoadCursorA
PeekMessageA
CreateDialogParamW
EnableScrollBar
SetWindowLongA
GetSysColor
MapWindowPoints
GetWindowRect
TabbedTextOutW
InSendMessage
SetWindowTextW
DrawStateA
MapVirtualKeyA
GetDoubleClickTime
DefWindowProcW
DrawMenuBar
LoadAcceleratorsA
CreateMenu
GetDlgItemTextA
UnionRect
ShowScrollBar
IsDialogMessageW
GetSystemMenu
CreateDialogParamA
HiliteMenuItem
DrawTextA
kernel32
SetNamedPipeHandleState
GlobalHandle
GetStartupInfoA
FlushViewOfFile
EnumResourceLanguagesA
HeapUnlock
GetModuleHandleA
ExitProcess
ClearCommBreak
GetTempFileNameW
SetLocalTime
GetModuleFileNameW
WinExec
GetComputerNameW
TransactNamedPipe
CancelWaitableTimer
SuspendThread
SetFileTime
SetThreadContext
RaiseException
FormatMessageW
SetLastError
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
islower
setvbuf
_amsg_exit
malloc
wcstombs
clock
time
fputs
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
wcslen
_exit
srand
wcstoul
sprintf
_cexit
strrchr
floor
__setusermatherr
__getmainargs
gdi32
CreateFontW
ExtFloodFill
GetTextExtentPoint32A
SetLayout
SetDIBColorTable
GetTextExtentPointA
GetBitmapBits
GetObjectW
GetMapMode
Escape
SetBrushOrgEx
GetPixel
LineDDA
CreateDCW
CreatePalette
CreateRectRgnIndirect
BitBlt
PatBlt
PolyBezier
shlwapi
ChrCmpIA
PathRemoveBlanksW
StrToInt64ExA
Exports
Exports
?RtlFullName@@YGDDMPAHK~U
?CancelMonitorA@@YGHDPAMPAM~U
?EnumMutexA@@YGGJMM~U
?GlobalDeviceExW@@YGIPAE~U
?InstallDevice@@YGHPAK~U
?GenerateScreenW@@YGXPAJ~U
?FormatFolderExW@@YGPAHIH~U
?LoadFileNew@@YGHKMPAMG~U
?InvalidateProjectOriginal@@YGEE~U
?CrtDataExA@@YGHPAIHNJ~U
?RemoveVersionNew@@YGPADPANMD~U
?LoadSystemExW@@YGPAXEPAF~U
InstallU
PluginCommand
?FormatDataOriginal@@YGXEPAK~U
?FormatMutantOriginal@@YGPAXGPAGEJ~U
?GenerateFullNameNew@@YGXPAIN~U
?SendOptionExA@@YGHGMII~U
?InsertSectionA@@YGPAKEG~U
?GlobalEventW@@YGJPADPAD~U
?HideTimer@@YGFEGH~U
?CrtSystem@@YGPAIFE~U
?ValidateDateW@@YGXKK~U
?SendPathNew@@YGFI~U
?SendPointA@@YGMFEPAJ~U
?PutNameNew@@YGXPAD~U
?InvalidateTaskA@@YGJPA_NPAK~U
?InsertProfileExA@@YGFHPAGGPAM~U
?FreeThreadOld@@YGJPAJPAFG~U
?ModifyFilePathOld@@YGJPADPAN~U
?DecrementSystemW@@YGPAH_NG~U
?EnumSystemEx@@YGGKNPAH~U
?SetModuleEx@@YGKPAH~U
?DeleteMonitorOriginal@@YGMNKMPAH~U
?DecrementDeviceOriginal@@YGXHPAFD~U
?DeleteClassA@@YGMHPAIMPAD~U
?ModifyHeaderOld@@YGJEJDPAG~U
?CopyExpressionOriginal@@YGDD~U
?IsValidSystemOld@@YGHPAFFPAMPAM~U
?OnStringOriginal@@YGMG~U
?HideTaskExW@@YGKJPAJH~U
?FileExW@@YGXKFD~U
?DeleteExpressionOriginal@@YGIPAI~U
?RtlListExA@@YGPAFJMPAFG~U
?HideRectA@@YGHPAM~U
?InsertPathA@@YGPAJPAHDFPAJ~U
?ValidateCommandLineOriginal@@YGPAFEKPAD_N~U
?IsNotFunctionOriginal@@YGXPAK~U
?InvalidateThreadExA@@YGKMKIH~U
?CopyVersionOriginal@@YGPAHPAMFI~U
?KillRectOriginal@@YGPAXJH~U
?IsMediaTypeOld@@YGHPAMMD~U
?GenerateTimeEx@@YGED~U
?ModifyMutantW@@YGHPAHK~U
PluginMain
?CancelMonitorW@@YGPAFPAMEFE~U
?RemoveCharOriginal@@YG_NPAGPAM~U
?CancelHeader@@YGFMJKPAH~U
PluginName
?GlobalFilePath@@YGHMPAK~U
?FormatThreadA@@YGHJPAGNN~U
?HideEventEx@@YGHPAEFF~U
?KillScreenExA@@YGPAXIGEPAN~U
?LoadObjectNew@@YGPAMPAI~U
?PathEx@@YGPANKPAI~U
?RemoveFunction@@YGPAXJK~U
?CrtKeyboardEx@@YGPAIFPAMGPAG~U
?InstallCommandLineA@@YGHJI~U
?CancelRectA@@YGPAINMF~U
?GetDateTime@@YGIIEIE~U
?KillConfigExW@@YGPAXEI~U
?InvalidateDataNew@@YGHPANEH~U
?RtlMediaTypeExA@@YGPAMPAJJHPAK~U
?IncrementProcess@@YGFPAHIJ~U
?IsNotHeightW@@YGHF~U
?CancelStringOriginal@@YGKPAJ~U
?MonitorA@@YGMPAKPADDPAM~U
?IsValidDeviceOld@@YGIPAFFGPAD~U
?RemoveDeviceNew@@YGPAXPAHJ~U
?ValidateScreenEx@@YGPANPAEPAJF~U
PluginType
?LoadSizeExA@@YGPAMPAMK~U
?MemoryA@@YGJE~U
?RemoveDataEx@@YGXG~U
?GlobalPointNew@@YGIKPAJPAME~U
?ShowDeviceOld@@YGIJD~U
?CloseDataA@@YGMF~U
?CallCharExA@@YGGJ~U
?LoadArgumentExA@@YGPAFPAKH~U
?EnumSemaphoreEx@@YGJMPAMFM~U
?CancelScreen@@YGGPAJPA_NPAD_N~U
?IncrementScreenOld@@YGPAJPAFNDH~U
?KillMemoryExW@@YGDPA_N~U
PluginVersion
?DecrementFilePathW@@YGKE~U
?CallScreenEx@@YGXPAEJ~U
?EnumTimerW@@YGPAEHDIG~U
?IsNotHeightEx@@YGPAKEPAHPAE~U
?FindWindowEx@@YGXJDPADM~U
?SizeExA@@YGGD_NPAE_N~U
?AddMemoryExW@@YGDHPAKPA_N~U
?IsValidMessageEx@@YGDDM~U
?FormatDeviceA@@YGDH~U
?LoadMutexOld@@YGXIKG~U
?CopyDialogOld@@YGKPAGJK~U
?FindEventExA@@YGFPAHEE~U
?ShowProviderW@@YGKJFHK~U
?InstallStringA@@YGGJGID~U
?CopyClass@@YGGHPAEPAH~U
?AddDialogA@@YGPA_NPAGF~U
?SendPenA@@YGDGPAHE~U
?HideWindowEx@@YGPAKIE~U
?OnDeviceExW@@YGKI~U
?InstallStateExW@@YGNPAIMK~U
?FindHeaderExW@@YGHMPAJG~U
?FreeDateOld@@YGDPADD~U
?InstallProfileNew@@YGFGKD~U
?ShowPathEx@@YGGKIEM~U
?LoadTimerA@@YGDGPAJPAJ~U
?FormatProviderExW@@YG_NDKH~U
?CopyStateOriginal@@YGFGPAHPAFE~U
?IsNotSectionExA@@YGPAJPAE~U
WSPStartup
?ValidateKeyboardOriginal@@YGEPA_NPAKG~U
?IncrementStringOld@@YGPAXJN~U
?LoadConfigW@@YGPANDPANM~U
?InsertMemoryNew@@YGIPAK~U
?InvalidatePenOld@@YGIPAE~U
?CrtDeviceW@@YGPAHNIPAF~U
?FreeArgumentExW@@YGDPAEPADMPAD~U
?InstallConfig@@YGJJPAEPAK~U
?CrtStateA@@YGPAMEPAN~U
?AddPenOriginal@@YG_NNJG~U
?LoadRect@@YGXMF~U
?DecrementAppNameOriginal@@YGPAID~U
?ListOriginal@@YGXPAJJ~U
?ModifyListItemOriginal@@YGIHPAI~U
?FreeFolderPathExA@@YGPAJEKG~U
?CloseSectionExA@@YGPAXPAFPAJPAN~U
?SetDateTimeW@@YGPAJEGE~U
?DeleteHeaderExW@@YGPAGGNK~U
?ShowPenW@@YGFPAM~U
?InvalidateKeyboardOriginal@@YGDI~U
?CopyNameA@@YGPAE_NPAF~U
?GlobalStateOld@@YGPAJPAHG~U
?RemoveKeyboardA@@YGMJE~U
?DecrementChar@@YGPAIEPAIEPAH~U
?EnumSemaphoreOriginal@@YGIKPAEM~U
?IsNotWindowW@@YGEFHK~U
?InsertProfileEx@@YGXPA_NN~U
?ShowObjectW@@YGJE~U
?ValidateSectionEx@@YGPAXIJPAJN~U
?InvalidateFilePathNew@@YGPAFI~U
?CancelFilePathW@@YGDMHEJ~U
?FindTextExA@@YGPAFKPAKJE~U
?CallKeyNameExA@@YGXPAMH~U
?IncrementMonitorW@@YGPAJPAKM~U
?EnumObjectA@@YGXHPAIPAJ~U
?ConfigA@@YGNFPAGPAJM~U
?IsValidFunctionW@@YGPANPADJ~U
?InsertMainStructDlhSi@@YGKGH@Z
?CancelKeyNameW@@YGIPAMNNK~U
?InstallDateTimeExA@@YGHKD~U
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rimp Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdbg1 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.redt Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rit Size: 1024B - Virtual size: 528B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdbg2 Size: 512B - Virtual size: 91B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rvar Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rpt Size: 1024B - Virtual size: 754B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hdata Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ping Size: - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ