o:\OOO320\src\goodies\wntmsci12.pro\bin\ipsmi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5c2f44db1e1c57c9c8c5e138ebd49917_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5c2f44db1e1c57c9c8c5e138ebd49917_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5c2f44db1e1c57c9c8c5e138ebd49917_JaffaCakes118
-
Size
21KB
-
MD5
5c2f44db1e1c57c9c8c5e138ebd49917
-
SHA1
6016548556a8cd9819e8bd77f6db56fc6dddd9a3
-
SHA256
abfe278b26df850208ad7ee9e465aa13876797cc2ed7514c3e75d67fd8e1c355
-
SHA512
051f50a0951137ca327cc1a447c911e45373413b376af86c6e25d302412a5830c8b76c7255bc0a7d20fe3e9152251c34040e7ce601eb4d1857770edff1d2b80c
-
SSDEEP
384:pmrXqV2Soa4FER8T16pbdzFFDb4M0uakUR3YzmhFO11HFLTw+F:pmkNxpbdhJb4Rp3nO1zLE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c2f44db1e1c57c9c8c5e138ebd49917_JaffaCakes118
Files
-
5c2f44db1e1c57c9c8c5e138ebd49917_JaffaCakes118.dll windows:5 windows x86 arch:x86
f4495852ff652ab3af326ff8c93b8cb3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
vclmi
??1MetaEPSAction@@MAE@XZ
?Read@MetaEPSAction@@UAEXAAVSvStream@@PAUImplMetaReadData@@@Z
?Write@MetaEPSAction@@UAEXAAVSvStream@@PAUImplMetaWriteData@@@Z
?Scale@MetaEPSAction@@UAEXNN@Z
?Move@MetaEPSAction@@UAEXJJ@Z
?Clone@MetaEPSAction@@UAEPAVMetaAction@@XZ
?Execute@MetaEPSAction@@UAEXPAVOutputDevice@@@Z
?Compare@MetaEPSAction@@EBEEABVMetaAction@@@Z
??0Graphic@@QAE@XZ
??0Bitmap@@QAE@ABVSize@@GPBVBitmapPalette@@@Z
?AcquireWriteAccess@Bitmap@@QAEPAVBitmapWriteAccess@@XZ
??0BitmapColor@@QAE@E@Z
?SetPixel@BitmapWriteAccess@@QAEXJJABVBitmapColor@@@Z
??1BitmapColor@@QAE@XZ
?ReleaseAccess@Bitmap@@QAEXPAVBitmapReadAccess@@@Z
??0GfxLink@@QAE@PAEKW4GfxLinkType@@E@Z
?GetGDIMetaFile@Graphic@@QBEABVGDIMetaFile@@XZ
??0MetaEPSAction@@QAE@ABVPoint@@ABVSize@@ABVGfxLink@@ABVGDIMetaFile@@@Z
??1GfxLink@@QAE@XZ
??0Font@@QAE@XZ
?SetLineColor@OutputDevice@@QAEXABVColor@@@Z
?SetFillColor@OutputDevice@@QAEXXZ
?SetColor@Font@@QAEXABVColor@@@Z
?Push@OutputDevice@@QAEXG@Z
?SetFont@OutputDevice@@QAEXABVFont@@@Z
?DrawRect@OutputDevice@@QAEXABVRectangle@@@Z
?DrawText@OutputDevice@@QAEXABVRectangle@@ABVString@@GPAV?$vector@VRectangle@@V?$allocator@VRectangle@@@_STL@@@_STL@@PAV3@@Z
?Pop@OutputDevice@@QAEXXZ
??1Font@@QAE@XZ
?Import@GraphicConverter@@SAKAAVSvStream@@AAVGraphic@@K@Z
??0VirtualDevice@@QAE@G@Z
??0GDIMetaFile@@QAE@XZ
??0GraphicConversionParameters@@QAE@ABVSize@@_N11@Z
?GetBitmap@Graphic@@QBE?AVBitmap@@ABVGraphicConversionParameters@@@Z
?GetPrefSize@Bitmap@@QBEABVSize@@XZ
?GetDefaultDevice@Application@@SAPAVOutputDevice@@XZ
??0MapMode@@QAE@W4MapUnit@@@Z
?GetPrefMapMode@Bitmap@@QBEABVMapMode@@XZ
?LogicToLogic@OutputDevice@@SA?AVSize@@ABV2@ABVMapMode@@1@Z
?GetSizePixel@Bitmap@@QBE?AVSize@@XZ
?PixelToLogic@OutputDevice@@QBE?AVSize@@ABV2@ABVMapMode@@@Z
??1MapMode@@QAE@XZ
?EnableOutput@OutputDevice@@QAEXE@Z
?Record@GDIMetaFile@@QAEXPAVOutputDevice@@@Z
?DrawBitmap@OutputDevice@@QAEXABVPoint@@ABVSize@@ABVBitmap@@@Z
??1Bitmap@@QAE@XZ
?Stop@GDIMetaFile@@QAEXXZ
?WindStart@GDIMetaFile@@QAEXXZ
?SetPrefMapMode@GDIMetaFile@@QAEXABVMapMode@@@Z
?SetPrefSize@GDIMetaFile@@QAEXABVSize@@@Z
??0Graphic@@QAE@ABVGDIMetaFile@@@Z
??4Graphic@@QAEAAV0@ABV0@@Z
??1Graphic@@UAE@XZ
??1GDIMetaFile@@UAE@XZ
??1VirtualDevice@@UAE@XZ
??1MetaCommentAction@@MAE@XZ
?Read@MetaCommentAction@@UAEXAAVSvStream@@PAUImplMetaReadData@@@Z
?Write@MetaCommentAction@@UAEXAAVSvStream@@PAUImplMetaWriteData@@@Z
?Scale@MetaCommentAction@@UAEXNN@Z
?Move@MetaCommentAction@@UAEXJJ@Z
?Clone@MetaCommentAction@@UAEPAVMetaAction@@XZ
?Execute@MetaCommentAction@@UAEXPAVOutputDevice@@@Z
?Compare@MetaCommentAction@@EBEEABVMetaAction@@@Z
??0MetaCommentAction@@QAE@ABVByteString@@JPBEK@Z
?AddAction@GDIMetaFile@@QAEXPAVMetaAction@@@Z
tlmi
?GetError@SvStream@@QBEKXZ
?SetNumberFormatInt@SvStream@@QAEXG@Z
??5SvStream@@QAEAAV0@AAK@Z
??5SvStream@@QAEAAV0@AAD@Z
??0Color@@QAE@K@Z
??0Rectangle@@QAE@ABVPoint@@ABVSize@@@Z
??0String@@QAE@XZ
??1ByteString@@QAE@XZ
??1SvMemoryStream@@UAE@XZ
?Flush@SvStream@@QAEXXZ
?Write@SvStream@@QAEKPBXK@Z
?Read@SvStream@@QAEKPAXK@Z
?Seek@SvStream@@QAEKK@Z
??6SvStream@@QAEAAV0@K@Z
??0SvMemoryStream@@QAE@KK@Z
??0ByteString@@QAE@PBD@Z
??1SvFileStream@@UAE@XZ
??0SvFileStream@@QAE@ABVString@@G@Z
??0String@@QAE@ABVOUString@rtl@@@Z
??1TempFile@@QAE@XZ
??1String@@QAE@XZ
??BString@@QBE?AVOUString@rtl@@XZ
?GetName@TempFile@@QBE?AVString@@XZ
?EnableKillingFile@TempFile@@QAEXE@Z
??0TempFile@@QAE@PBVString@@E@Z
?Append@String@@QAEAAV1@ABV1@@Z
?CreateFromInt32@String@@SA?AV1@JF@Z
?AppendAscii@String@@QAEAAV1@PBD@Z
sal3
osl_readFile
osl_getCurrentSecurity
osl_executeProcess_WithRedirectedIO
osl_writeFile
osl_closeFile
osl_readLine
osl_joinProcess
osl_freeProcessHandle
osl_getSystemPathFromFileURL
rtl_byte_sequence_release
rtl_byte_sequence_construct
rtl_uString_release
rtl_string2UString
rtl_uString_new
rtl_str_indexOfStr_WithLength
rtl_string_release
rtl_string_newFromStr_WithLength
rtl_string_newFromStr
msvcr90
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
??3@YAXPAX@Z
??2@YAPAXI@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
Exports
Exports
GetVersionInfo
GraphicImport
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ