O:\OOO330\ooo\regexp\wntmsci12.pro\bin\i18nregexpMSC.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3f58413adcc6633e4a2b9446e941d83a_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3f58413adcc6633e4a2b9446e941d83a_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3f58413adcc6633e4a2b9446e941d83a_JaffaCakes118
-
Size
32KB
-
MD5
3f58413adcc6633e4a2b9446e941d83a
-
SHA1
f71ea786e129735c33b603d2b980a25509528bea
-
SHA256
86d17e70c686369ccb47970bb60fd424ddc51c198b3b671f4a6e4beae7e09b18
-
SHA512
955580eaf5bb854695eececf88406627738baeb578e6d06a3382a73ea3ea251fa95e99a75231cf6ce3880c6280fa3f8827c3d6ebd414c5c03d35bc45ea35d037
-
SSDEEP
768:rv+mlsLT4Aj+zssl/v7aqInttROtblHdjIL:T+mET4AjOssNv7aqInLROtbldjU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f58413adcc6633e4a2b9446e941d83a_JaffaCakes118
Files
-
3f58413adcc6633e4a2b9446e941d83a_JaffaCakes118.dll windows:5 windows x86 arch:x86
9f6a639d814b091321e7fddcfe7010e5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
sal3
rtl_ustr_compare
rtl_uString_newFromAscii
rtl_ustr_compare_WithLength
rtl_uString_release
rtl_uString_newFromStr
i18nutilmsc
?isAlpha@unicode@@SAEG@Z
?isControl@unicode@@SAEG@Z
?isDigit@unicode@@SAEG@Z
?isLower@unicode@@SAEG@Z
?isPrint@unicode@@SAEG@Z
?isSpace@unicode@@SAEG@Z
?isUpper@unicode@@SAEG@Z
?isAlphaDigit@unicode@@SAEG@Z
msvcr90
__CxxFrameHandler3
free
realloc
abort
malloc
memcpy
memset
??3@YAXPAX@Z
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
Exports
Exports
??$static_int_cast@GJ@sal@@YAGJ@Z
??0?$Reference@VXExtendedTransliteration@i18n@star@sun@com@@@uno@star@sun@com@@QAE@XZ
??0OUString@rtl@@AAE@PAU_rtl_uString@@PAVDO_NOT_ACQUIRE@01@@Z
??0OUString@rtl@@QAE@PBG@Z
??0Regexpr@@QAE@ABUSearchOptions@util@star@sun@com@@V?$Reference@VXExtendedTransliteration@i18n@star@sun@com@@@uno@345@@Z
??1?$Reference@VXExtendedTransliteration@i18n@star@sun@com@@@uno@star@sun@com@@QAE@XZ
??1?$Reference@VXInterface@uno@star@sun@com@@@uno@star@sun@com@@QAE@XZ
??1Exception@uno@star@sun@com@@QAE@XZ
??1MultipleCharsOutputException@i18n@star@sun@com@@QAE@XZ
??1OUString@rtl@@QAE@XZ
??1Regexpr@@QAE@XZ
??4?$Reference@VXExtendedTransliteration@i18n@star@sun@com@@@uno@star@sun@com@@QAAAAV01234@ABV01234@@Z
??8rtl@@YAEABVOUString@0@PBG@Z
??C?$Reference@VXExtendedTransliteration@i18n@star@sun@com@@@uno@star@sun@com@@QBAPAVXExtendedTransliteration@i18n@234@XZ
??_R0?AVMultipleCharsOutputException@i18n@star@sun@com@@@8
?alt_match_null_string_p@Regexpr@@AAEEPAG0PATregister_info_type@@@Z
?at_begline_loc_p@Regexpr@@AAEEPBG0@Z
?at_endline_loc_p@Regexpr@@AAEEPBG0@Z
?bcmp_translate@Regexpr@@AAEJPBG0J@Z
?castFromXInterface@?$Reference@VXExtendedTransliteration@i18n@star@sun@com@@@uno@star@sun@com@@CAPAVXExtendedTransliteration@i18n@345@PAVXInterface@2345@@Z
?castToXInterface@?$Reference@VXExtendedTransliteration@i18n@star@sun@com@@@uno@star@sun@com@@CAPAVXInterface@2345@PAVXExtendedTransliteration@i18n@345@@Z
?common_op_match_null_string_p@Regexpr@@AAEEPAPAGPAGPATregister_info_type@@@Z
?compareTo@OUString@rtl@@QBEJABV12@@Z
?compile_range@Regexpr@@AAE?AW4reg_errcode_t@@GGPAG@Z
?createFromAscii@OUString@rtl@@SA?AV12@PBD@Z
?extract_number@Regexpr@@AAEXAAJPAG@Z
?extract_number_and_incr@Regexpr@@AAEXAAJAAPAG@Z
?getLength@OUString@rtl@@QBEJXZ
?getStr@OUString@rtl@@QBEPBGXZ
?group_in_compile_stack@Regexpr@@AAEEUcompile_stack_type@@K@Z
?group_match_null_string_p@Regexpr@@AAEEPAPAGPAGPATregister_info_type@@@Z
?insert_op1@Regexpr@@AAEXW4re_opcode_t@@PAGJ1@Z
?insert_op2@Regexpr@@AAEXW4re_opcode_t@@PAGJJ1@Z
?is@BaseReference@uno@star@sun@com@@QBAEXZ
?iswordbegin@Regexpr@@AAEEPBGPAGJ@Z
?iswordend@Regexpr@@AAEEPBGPAGJ@Z
?re_match2@Regexpr@@AAEJPAUre_registers@@JJ@Z
?re_search@Regexpr@@QAEJPAUre_registers@@J@Z
?regcomp@Regexpr@@AAEJXZ
?regex_compile@Regexpr@@AAEJXZ
?set@?$Reference@VXExtendedTransliteration@i18n@star@sun@com@@@uno@star@sun@com@@QAAEPAVXExtendedTransliteration@i18n@345@@Z
?set_line@Regexpr@@QAEXPBGJ@Z
?set_list_bit@Regexpr@@AAEXGPAG@Z
?store_number@Regexpr@@AAEXPAGJ@Z
?store_number_and_incr@Regexpr@@AAEXAAPAGJ@Z
?store_op1@Regexpr@@AAEXW4re_opcode_t@@PAGJ@Z
?store_op2@Regexpr@@AAEXW4re_opcode_t@@PAGJJ@Z
GetVersionInfo
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 780B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ