O:\OOO330\ooo\filter\wntmsci12.pro\bin\ipsmi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4dfb1119268b9e24a49e6d0093d9fae4_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4dfb1119268b9e24a49e6d0093d9fae4_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4dfb1119268b9e24a49e6d0093d9fae4_JaffaCakes118
-
Size
21KB
-
MD5
4dfb1119268b9e24a49e6d0093d9fae4
-
SHA1
35436bef9738f51f7c6ba0c507407efe5d1ea37f
-
SHA256
01f02d9fccde670fabe78e73a92134afc5f889c76feaf6b4d0223fa358363caf
-
SHA512
b835dc36540668c58f1395771b1683d16811a7a76e7cd729434dd4dab91968a488954bf01260bca8db3a3d620b49072b88e633012ac3e9a583bf9d47fb57fb59
-
SSDEEP
384:A9xNMOR/Yc6QR7OJxemR5SkpYFYTg2ULste//c3ofO11HojqcQ:YeQR7OJx35/YmI/1fO1WWc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4dfb1119268b9e24a49e6d0093d9fae4_JaffaCakes118
Files
-
4dfb1119268b9e24a49e6d0093d9fae4_JaffaCakes118.dll windows:5 windows x86 arch:x86
f3527237e0e8172f4d788fead4328d0f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
vclmi
??1MetaEPSAction@@MAE@XZ
?Read@MetaEPSAction@@UAEXAAVSvStream@@PAUImplMetaReadData@@@Z
?Write@MetaEPSAction@@UAEXAAVSvStream@@PAUImplMetaWriteData@@@Z
?Scale@MetaEPSAction@@UAEXNN@Z
?Move@MetaEPSAction@@UAEXJJ@Z
?Clone@MetaEPSAction@@UAEPAVMetaAction@@XZ
?Execute@MetaEPSAction@@UAEXPAVOutputDevice@@@Z
?Compare@MetaEPSAction@@EBEEABVMetaAction@@@Z
??0Graphic@@QAE@XZ
??0Bitmap@@QAE@ABVSize@@GPBVBitmapPalette@@@Z
?AcquireWriteAccess@Bitmap@@QAEPAVBitmapWriteAccess@@XZ
?SetPixel@BitmapWriteAccess@@QAEXJJABVBitmapColor@@@Z
?ReleaseAccess@Bitmap@@QAEXPAVBitmapReadAccess@@@Z
??0GfxLink@@QAE@PAEKW4GfxLinkType@@E@Z
?GetGDIMetaFile@Graphic@@QBEABVGDIMetaFile@@XZ
??0MetaEPSAction@@QAE@ABVPoint@@ABVSize@@ABVGfxLink@@ABVGDIMetaFile@@@Z
??1GfxLink@@QAE@XZ
??0Font@@QAE@XZ
?SetLineColor@OutputDevice@@QAEXABVColor@@@Z
?SetFillColor@OutputDevice@@QAEXXZ
?SetColor@Font@@QAEXABVColor@@@Z
?Push@OutputDevice@@QAEXG@Z
?SetFont@OutputDevice@@QAEXABVFont@@@Z
?DrawRect@OutputDevice@@QAEXABVRectangle@@@Z
?DrawText@OutputDevice@@QAEXABVRectangle@@ABVString@@GPAV?$vector@VRectangle@@V?$allocator@VRectangle@@@_STL@@@_STL@@PAV3@PAVITextLayout@vcl@@@Z
?Pop@OutputDevice@@QAEXXZ
??1Font@@QAE@XZ
??1MetaCommentAction@@MAE@XZ
?Read@MetaCommentAction@@UAEXAAVSvStream@@PAUImplMetaReadData@@@Z
?Write@MetaCommentAction@@UAEXAAVSvStream@@PAUImplMetaWriteData@@@Z
?Scale@MetaCommentAction@@UAEXNN@Z
?Move@MetaCommentAction@@UAEXJJ@Z
?Clone@MetaCommentAction@@UAEPAVMetaAction@@XZ
?Execute@MetaCommentAction@@UAEXPAVOutputDevice@@@Z
?Compare@MetaCommentAction@@EBEEABVMetaAction@@@Z
??0MetaCommentAction@@QAE@ABVByteString@@JPBEK@Z
?AddAction@GDIMetaFile@@QAEXPAVMetaAction@@@Z
?Import@GraphicConverter@@SAKAAVSvStream@@AAVGraphic@@K@Z
??0VirtualDevice@@QAE@G@Z
??0GDIMetaFile@@QAE@XZ
??0GraphicConversionParameters@@QAE@ABVSize@@_N11@Z
?GetBitmap@Graphic@@QBE?AVBitmap@@ABVGraphicConversionParameters@@@Z
?GetDefaultDevice@Application@@SAPAVOutputDevice@@XZ
??0MapMode@@QAE@W4MapUnit@@@Z
?LogicToLogic@OutputDevice@@SA?AVSize@@ABV2@ABVMapMode@@1@Z
?GetSizePixel@Bitmap@@QBE?AVSize@@XZ
?PixelToLogic@OutputDevice@@QBE?AVSize@@ABV2@ABVMapMode@@@Z
??1MapMode@@QAE@XZ
?EnableOutput@OutputDevice@@QAEXE@Z
?Record@GDIMetaFile@@QAEXPAVOutputDevice@@@Z
?DrawBitmap@OutputDevice@@QAEXABVPoint@@ABVSize@@ABVBitmap@@@Z
??1Bitmap@@QAE@XZ
?Stop@GDIMetaFile@@QAEXXZ
?WindStart@GDIMetaFile@@QAEXXZ
??4MapMode@@QAEAAV0@ABV0@@Z
??0Graphic@@QAE@ABVGDIMetaFile@@@Z
??4Graphic@@QAEAAV0@ABV0@@Z
??1Graphic@@UAE@XZ
??1GDIMetaFile@@UAE@XZ
??1VirtualDevice@@UAE@XZ
tlmi
??1SvFileStream@@UAE@XZ
??0SvFileStream@@QAE@ABVString@@G@Z
??0String@@QAE@ABVOUString@rtl@@@Z
??1TempFile@@QAE@XZ
??1String@@QAE@XZ
??BString@@QBE?AVOUString@rtl@@XZ
?GetName@TempFile@@QBE?AVString@@XZ
??0TempFile@@QAE@PBVString@@E@Z
??1ByteString@@QAE@XZ
??1SvMemoryStream@@UAE@XZ
?Flush@SvStream@@QAEXXZ
?Write@SvStream@@QAEKPBXK@Z
?Read@SvStream@@QAEKPAXK@Z
?Seek@SvStream@@QAEKK@Z
??6SvStream@@QAEAAV0@K@Z
??0SvMemoryStream@@QAE@KK@Z
??0ByteString@@QAE@PBD@Z
?Append@String@@QAEAAV1@ABV1@@Z
?CreateFromInt32@String@@SA?AV1@JF@Z
?AppendAscii@String@@QAEAAV1@PBD@Z
??0String@@QAE@XZ
??0Rectangle@@QAE@ABVPoint@@ABVSize@@@Z
??5SvStream@@QAEAAV0@AAD@Z
??5SvStream@@QAEAAV0@AAK@Z
?SetNumberFormatInt@SvStream@@QAEXG@Z
?GetError@SvStream@@QBEKXZ
sal3
osl_readFile
osl_writeFile
osl_closeFile
osl_readLine
osl_joinProcess
osl_freeProcessHandle
osl_searchFileURL
osl_getCurrentSecurity
osl_executeProcess_WithRedirectedIO
osl_getSystemPathFromFileURL
rtl_byte_sequence_release
rtl_byte_sequence_construct
rtl_uString_release
rtl_string2UString
rtl_uString_newFromStr
rtl_uString_new
rtl_str_indexOfStr_WithLength
rtl_string_release
rtl_string_newFromStr_WithLength
rtl_string_newFromStr
msvcr90
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
??3@YAXPAX@Z
??2@YAPAXI@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_wgetenv
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
Exports
Exports
GetVersionInfo
GraphicImport
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ