d:\cm\build\public\ee_m14r2_25092006\csi\projects\ee\dist_staging\Release\Cod\servicemanager\AOLSvcMgr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2fc6edb348845b12f7a7e69c534ddd38_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2fc6edb348845b12f7a7e69c534ddd38_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2fc6edb348845b12f7a7e69c534ddd38_JaffaCakes118
-
Size
373KB
-
MD5
2fc6edb348845b12f7a7e69c534ddd38
-
SHA1
0bb9ed864b3649f73878ccfa650efc0d038a9cb4
-
SHA256
351666a829ba78a7a1f262bd17000c57f599ced416603833f71e43e525f618a7
-
SHA512
a6305765104e93d116cb58f0b97928679611666e4d1cd1c4a444a2b13b99ec23c3ea6827e47227eb5829c7d686c6e805b15f377f5f2ddb7156778e159bfb7030
-
SSDEEP
6144:khvcfqnQszD/4qx2CqkYnRH3hcr2iP+WHfqQcbYAJ1EBACoGM2eNzPfQpT:kZcfqnQsAqoCq3RH3M2W+2qQcbcM2eNg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2fc6edb348845b12f7a7e69c534ddd38_JaffaCakes118
Files
-
2fc6edb348845b12f7a7e69c534ddd38_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
04f7ced1cd3abf0a2fe110b8b2771971
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
InterlockedIncrement
InterlockedDecrement
SetEvent
FindCloseChangeNotification
FindNextChangeNotification
FindClose
CompareStringA
InterlockedExchange
GetModuleHandleA
CloseHandle
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
GetLastError
SetLastError
IsBadCodePtr
GetLongPathNameA
LoadLibraryExA
Sleep
WaitForSingleObject
FreeLibrary
SetProcessShutdownParameters
GetModuleFileNameA
ExitProcess
GetUserDefaultLCID
UnmapViewOfFile
MapViewOfFile
VirtualQuery
GetCurrentProcess
GetProcessWorkingSetSize
SetProcessWorkingSetSize
GetCurrentThreadId
InterlockedCompareExchange
IsDebuggerPresent
GetCurrentProcessId
DebugBreak
ResetEvent
advapi32
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
user32
OpenDesktopW
EndDialog
TranslateMessage
MsgWaitForMultipleObjects
SetTimer
KillTimer
DestroyWindow
WaitForInputIdle
EnumDesktopWindows
ole32
CreateBindCtx
CoTaskMemFree
StringFromCLSID
CoRegisterMessageFilter
CoUnmarshalInterface
CoCreateInstance
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoRevokeClassObject
CoRegisterClassObject
CreateStreamOnHGlobal
oleaut32
SafeArrayRedim
SafeArrayPutElement
SafeArrayUnaccessData
SafeArrayUnlock
SafeArrayCreate
SafeArrayLock
VariantChangeTypeEx
SysAllocString
SafeArrayDestroy
VariantInit
VariantClear
SafeArrayCopy
VariantCopy
SafeArrayGetElement
xprt5
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
??1TFileFinder@XPRT@@UAE@XZ
?FindNext@TFileFinder@XPRT@@QAE_NI@Z
?Remove@TFile@XPRT@@SA_NPBG@Z
?GetFileSpec@TFileFinder@XPRT@@QBE?AVTBstr@2@XZ
?Find@TFileFinder@XPRT@@QAE_NPBGI@Z
??0TFileFinder@XPRT@@QAE@XZ
_XprtCompareString@8
_XprtHashString@4
?GetInfo@TFile@XPRT@@SA_NPBGAAVTFileInfo@2@@Z
?IsLoaded@TLibrary@XPRT@@QBE_NXZ
?GetProcAddress@TLibrary@XPRT@@QBEP6GHXZPBD@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?Find@TBstr@XPRT@@QBEHPBGH@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
_XprtDestroyThread@8
_XprtCreateThread@8
??0TPtrList@XPRT@@QAE@H@Z
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
_XprtGetMicroseconds@0
?Empty@TBstr@XPRT@@QAEXXZ
?Remove@TBstr@XPRT@@QAEHG@Z
_XprtMemAlloc@4
_XprtUtf8ToString@16
xprt_strlen
_XprtMessageLoop@0
XML_SetProcessingInstructionHandler
XML_SetCharacterDataHandler
XML_SetElementHandler
XML_SetUserData
XML_ParserCreate
XML_GetBuffer
XML_GetCurrentColumnNumber
XML_GetCurrentLineNumber
XML_ErrorString
XML_GetErrorCode
XML_ParseBuffer
_XprtEntityEscape@8
??1TFile@XPRT@@UAE@XZ
?Read@TFile@XPRT@@UAEHPAXH@Z
?Open@TFile@XPRT@@QAE_NPBGI_N@Z
??0TFile@XPRT@@QAE@XZ
?Set@TTime@XPRT@@QAEXN@Z
?Delete@TBstr@XPRT@@QAEHHH@Z
?RemoveAll@TPtrList@XPRT@@QAEXXZ
?AddHead@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
?MakeLower@TBstr@XPRT@@QAEAAV12@XZ
?FileNameFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?ToInt@TBstr@XPRT@@QBEHH@Z
?Init@TCritSec@XPRT@@QAEXXZ
?Term@TCritSec@XPRT@@QAEXXZ
?Lock@TCritSec@XPRT@@QAEXXZ
?Unlock@TCritSec@XPRT@@QAEXXZ
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
_XprtSeedRandom@8
_XprtGetMicroseconds64@0
xprt_memset
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
??3TXprtAllocated@XPRT@@SAXPAX@Z
??1TLibrary@XPRT@@UAE@XZ
??2TXprtAllocated@XPRT@@SAPAXI@Z
_XprtAtomicIncrement@4
?Init@TFileInfo@XPRT@@IAEXPBGI_JABVTTime@2@22@Z
_XprtTlsSetValue@8
_XprtTlsGetValue@4
_XprtTlsReleaseKey@4
_XprtTlsRequestKey@0
XprtTrace
_XprtUrlEncode@8
xprt_strcmp
xprt_memmove
xprt_strlcpy
??0TBstr@XPRT@@QAE@GH@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Lock@TSpinLock@XPRT@@QAEXXZ
?Unlock@TSpinLock@XPRT@@QAEXXZ
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?FindOneOf@TBstr@XPRT@@QBEHPBG@Z
xprt_iswdigit
?IsOpen@TFile@XPRT@@QBE_NXZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
XprtTrace2
?CanonicalizeSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
_XprtBinToBase64@16
?Load@TLibrary@XPRT@@QAE_NPBG@Z
??0TLibrary@XPRT@@QAE@XZ
?TrimRight@TBstr@XPRT@@QAEAAV12@G@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@G@Z
xprt_wcsicmp
?RemoveTrailingSeparator@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
_XprtRequestMessageId@0
_XprtRegisterMessageCallback@8
_XprtGetSystemInfo@0
_XprtMemFree@4
kSystemEncoding
_XprtGetMessageQueue@0
_XprtPostMessage@16
??0TBstr@XPRT@@QAE@PBG@Z
?Detach@TBstr@XPRT@@QAEPAGXZ
??0TBstr@XPRT@@QAE@XZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
??1TBstr@XPRT@@QAE@XZ
_XprtUnregisterMessageCallback@4
_XprtReleaseMessageId@4
_XprtPostQuitMessage@8
?Compare@TBstr@XPRT@@QBEHPBG@Z
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??0TPtrArray@XPRT@@QAE@XZ
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
_XprtGetMilliseconds@0
_XprtInitialize@8
?Left@TBstr@XPRT@@QBE?AV12@H@Z
_XprtUninitialize@0
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
xprt_wcslen
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
_XprtFreeString@4
_XprtAllocString@4
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??1TPtrFromPtrMap@XPRT@@QAE@XZ
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?GetAt@TBstr@XPRT@@QBEGH@Z
_XprtCompareNormal@8
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
_XprtGenerateRandom@8
??1TPtrList@XPRT@@QAE@XZ
?RemoveHead@TPtrList@XPRT@@QAEPAXXZ
?AddTail@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
xprt_memcpy
_XprtStringLen@4
?Format@TBstr@XPRT@@QAAXPBGZZ
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?RemoveAt@TPtrArray@XPRT@@QAEXHH@Z
??1TPtrArray@XPRT@@QAE@XZ
?InsertAt@TPtrArray@XPRT@@QAEXHPAXH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
_XprtAtomicDecrement@4
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
xprt_ucslcpy
??0TBstr@XPRT@@QAE@PBDPBG@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
?ReverseFind@TBstr@XPRT@@QBEHG@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?Right@TBstr@XPRT@@QBE?AV12@H@Z
?CompareNoCase@TBstr@XPRT@@QBEHPBG@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?IsEmpty@TBstr@XPRT@@QBE_NXZ
xprt_wcscmp
??0TBstr@XPRT@@QAE@PBDHPBG@Z
?Sleep@TThread@XPRT@@SAXI@Z
XML_ParserFree
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
_wcsicmp
_getpid
memset
_vsnprintf
_except_handler3
setlocale
_snwprintf
qsort
strcmp
strcpy
strcat
malloc
free
strlen
wcsstr
strncmp
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
_wcslwr
Exports
Exports
AOLLaunchEntry
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EEGetModuleInterop
EETrace
ServiceHostEntry
gSMEnableTracingPtr
Sections
.text Size: 170KB - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 31KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.eeSMCac Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 79KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE