d:\cm\build\public\ee_m14r2_25092006\csi\projects\ee\dist_staging\Release\Cod\servicemanager\AOLSvcMgr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6ad6010a38159c159e01fcc80ee54b19_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6ad6010a38159c159e01fcc80ee54b19_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6ad6010a38159c159e01fcc80ee54b19_JaffaCakes118
-
Size
401KB
-
MD5
6ad6010a38159c159e01fcc80ee54b19
-
SHA1
b977cac2359bf7b13fe43ea143f541a9ab5ac9cd
-
SHA256
ed045d520ac762438bb4a91f0cb395323a9c839f9fae9a82d6bd59d55e8a50f3
-
SHA512
9d35a07d79c9337de22b5fd88b62bcc56c3bc8694bbf09c6667334ee5ccaaeea40b63398ac14b92e29f81429d4ea286cfbf376a7b94746706f94163880b848f8
-
SSDEEP
12288:uZcfqnQsAqoCq3RH3M2W+2qQcbcMW2wbY0q:ugZC0R8ErW2wEH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6ad6010a38159c159e01fcc80ee54b19_JaffaCakes118
Files
-
6ad6010a38159c159e01fcc80ee54b19_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
04f7ced1cd3abf0a2fe110b8b2771971
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
InterlockedIncrement
InterlockedDecrement
SetEvent
FindCloseChangeNotification
FindNextChangeNotification
FindClose
CompareStringA
InterlockedExchange
GetModuleHandleA
CloseHandle
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
GetLastError
SetLastError
IsBadCodePtr
GetLongPathNameA
LoadLibraryExA
Sleep
WaitForSingleObject
FreeLibrary
SetProcessShutdownParameters
GetModuleFileNameA
ExitProcess
GetUserDefaultLCID
UnmapViewOfFile
MapViewOfFile
VirtualQuery
GetCurrentProcess
GetProcessWorkingSetSize
SetProcessWorkingSetSize
GetCurrentThreadId
InterlockedCompareExchange
IsDebuggerPresent
GetCurrentProcessId
DebugBreak
ResetEvent
advapi32
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
user32
OpenDesktopW
EndDialog
TranslateMessage
MsgWaitForMultipleObjects
SetTimer
KillTimer
DestroyWindow
WaitForInputIdle
EnumDesktopWindows
ole32
CreateBindCtx
CoTaskMemFree
StringFromCLSID
CoRegisterMessageFilter
CoUnmarshalInterface
CoCreateInstance
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoRevokeClassObject
CoRegisterClassObject
CreateStreamOnHGlobal
oleaut32
SafeArrayRedim
SafeArrayPutElement
SafeArrayUnaccessData
SafeArrayUnlock
SafeArrayCreate
SafeArrayLock
VariantChangeTypeEx
SysAllocString
SafeArrayDestroy
VariantInit
VariantClear
SafeArrayCopy
VariantCopy
SafeArrayGetElement
xprt5
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
??1TFileFinder@XPRT@@UAE@XZ
?FindNext@TFileFinder@XPRT@@QAE_NI@Z
?Remove@TFile@XPRT@@SA_NPBG@Z
?GetFileSpec@TFileFinder@XPRT@@QBE?AVTBstr@2@XZ
?Find@TFileFinder@XPRT@@QAE_NPBGI@Z
??0TFileFinder@XPRT@@QAE@XZ
_XprtCompareString@8
_XprtHashString@4
?GetInfo@TFile@XPRT@@SA_NPBGAAVTFileInfo@2@@Z
?IsLoaded@TLibrary@XPRT@@QBE_NXZ
?GetProcAddress@TLibrary@XPRT@@QBEP6GHXZPBD@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?Find@TBstr@XPRT@@QBEHPBGH@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
_XprtDestroyThread@8
_XprtCreateThread@8
??0TPtrList@XPRT@@QAE@H@Z
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
_XprtGetMicroseconds@0
?Empty@TBstr@XPRT@@QAEXXZ
?Remove@TBstr@XPRT@@QAEHG@Z
_XprtMemAlloc@4
_XprtUtf8ToString@16
xprt_strlen
_XprtMessageLoop@0
XML_SetProcessingInstructionHandler
XML_SetCharacterDataHandler
XML_SetElementHandler
XML_SetUserData
XML_ParserCreate
XML_GetBuffer
XML_GetCurrentColumnNumber
XML_GetCurrentLineNumber
XML_ErrorString
XML_GetErrorCode
XML_ParseBuffer
_XprtEntityEscape@8
??1TFile@XPRT@@UAE@XZ
?Read@TFile@XPRT@@UAEHPAXH@Z
?Open@TFile@XPRT@@QAE_NPBGI_N@Z
??0TFile@XPRT@@QAE@XZ
?Set@TTime@XPRT@@QAEXN@Z
?Delete@TBstr@XPRT@@QAEHHH@Z
?RemoveAll@TPtrList@XPRT@@QAEXXZ
?AddHead@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
?MakeLower@TBstr@XPRT@@QAEAAV12@XZ
?FileNameFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?ToInt@TBstr@XPRT@@QBEHH@Z
?Init@TCritSec@XPRT@@QAEXXZ
?Term@TCritSec@XPRT@@QAEXXZ
?Lock@TCritSec@XPRT@@QAEXXZ
?Unlock@TCritSec@XPRT@@QAEXXZ
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
_XprtSeedRandom@8
_XprtGetMicroseconds64@0
xprt_memset
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
??3TXprtAllocated@XPRT@@SAXPAX@Z
??1TLibrary@XPRT@@UAE@XZ
??2TXprtAllocated@XPRT@@SAPAXI@Z
_XprtAtomicIncrement@4
?Init@TFileInfo@XPRT@@IAEXPBGI_JABVTTime@2@22@Z
_XprtTlsSetValue@8
_XprtTlsGetValue@4
_XprtTlsReleaseKey@4
_XprtTlsRequestKey@0
XprtTrace
_XprtUrlEncode@8
xprt_strcmp
xprt_memmove
xprt_strlcpy
??0TBstr@XPRT@@QAE@GH@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Lock@TSpinLock@XPRT@@QAEXXZ
?Unlock@TSpinLock@XPRT@@QAEXXZ
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?FindOneOf@TBstr@XPRT@@QBEHPBG@Z
xprt_iswdigit
?IsOpen@TFile@XPRT@@QBE_NXZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
XprtTrace2
?CanonicalizeSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
_XprtBinToBase64@16
?Load@TLibrary@XPRT@@QAE_NPBG@Z
??0TLibrary@XPRT@@QAE@XZ
?TrimRight@TBstr@XPRT@@QAEAAV12@G@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@G@Z
xprt_wcsicmp
?RemoveTrailingSeparator@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
_XprtRequestMessageId@0
_XprtRegisterMessageCallback@8
_XprtGetSystemInfo@0
_XprtMemFree@4
kSystemEncoding
_XprtGetMessageQueue@0
_XprtPostMessage@16
??0TBstr@XPRT@@QAE@PBG@Z
?Detach@TBstr@XPRT@@QAEPAGXZ
??0TBstr@XPRT@@QAE@XZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
??1TBstr@XPRT@@QAE@XZ
_XprtUnregisterMessageCallback@4
_XprtReleaseMessageId@4
_XprtPostQuitMessage@8
?Compare@TBstr@XPRT@@QBEHPBG@Z
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??0TPtrArray@XPRT@@QAE@XZ
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
_XprtGetMilliseconds@0
_XprtInitialize@8
?Left@TBstr@XPRT@@QBE?AV12@H@Z
_XprtUninitialize@0
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
xprt_wcslen
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
_XprtFreeString@4
_XprtAllocString@4
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??1TPtrFromPtrMap@XPRT@@QAE@XZ
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?GetAt@TBstr@XPRT@@QBEGH@Z
_XprtCompareNormal@8
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
_XprtGenerateRandom@8
??1TPtrList@XPRT@@QAE@XZ
?RemoveHead@TPtrList@XPRT@@QAEPAXXZ
?AddTail@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
xprt_memcpy
_XprtStringLen@4
?Format@TBstr@XPRT@@QAAXPBGZZ
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?RemoveAt@TPtrArray@XPRT@@QAEXHH@Z
??1TPtrArray@XPRT@@QAE@XZ
?InsertAt@TPtrArray@XPRT@@QAEXHPAXH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
_XprtAtomicDecrement@4
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
xprt_ucslcpy
??0TBstr@XPRT@@QAE@PBDPBG@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
?ReverseFind@TBstr@XPRT@@QBEHG@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?Right@TBstr@XPRT@@QBE?AV12@H@Z
?CompareNoCase@TBstr@XPRT@@QBEHPBG@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?IsEmpty@TBstr@XPRT@@QBE_NXZ
xprt_wcscmp
??0TBstr@XPRT@@QAE@PBDHPBG@Z
?Sleep@TThread@XPRT@@SAXI@Z
XML_ParserFree
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
_wcsicmp
_getpid
memset
_vsnprintf
_except_handler3
setlocale
_snwprintf
qsort
strcmp
strcpy
strcat
malloc
free
strlen
wcsstr
strncmp
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
_wcslwr
Exports
Exports
AOLLaunchEntry
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EEGetModuleInterop
EETrace
ServiceHostEntry
gSMEnableTracingPtr
Sections
.text Size: 170KB - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 31KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.eeSMCac Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 107KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE