d:\cm\build\public\abPrintAugust_1006\ee_services\addressBookPrint\src\win\Release\abPrintSvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8279fe2a1356d0de220bd71e56fdccd9_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8279fe2a1356d0de220bd71e56fdccd9_JaffaCakes118.dll
Resource
win10v2004-20240730-en
General
-
Target
8279fe2a1356d0de220bd71e56fdccd9_JaffaCakes118
-
Size
196KB
-
MD5
8279fe2a1356d0de220bd71e56fdccd9
-
SHA1
e56e0cccee830ea05da3880fa455037bf2e02aac
-
SHA256
56ba66f9436b9ed4e03390073732395e2f6e2ee98a82069b54b5196983001c8a
-
SHA512
3c4dfe5bdbbf6af83178d0a9979f8d9645382c8a9e6005e0d05d6085f00484cb0662902b24756f911914eb9d56e8eb32a09c0ecc73af533b8333ec73aaa97711
-
SSDEEP
3072:A9uEzOn/Qsgpn2DcDjHoYGq8nv7vAqHlqLtbaO4L7mr5kRffD65DwmUWWi3hW:/jgpn2DcDjIPvp8uDfe5DwU/3M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8279fe2a1356d0de220bd71e56fdccd9_JaffaCakes118
Files
-
8279fe2a1356d0de220bd71e56fdccd9_JaffaCakes118.dll windows:4 windows x86 arch:x86
94113205e1b36dec06802af345446344
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
GetModuleHandleA
GetLastError
SetLastError
DisableThreadLibraryCalls
InterlockedExchange
CompareStringA
ExitProcess
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
CloseHandle
FreeLibrary
GlobalAlloc
GetSystemDefaultLCID
GlobalLock
GlobalUnlock
LoadLibraryA
GlobalFree
user32
SetTimer
KillTimer
TranslateMessage
MsgWaitForMultipleObjects
gdi32
SetMapMode
SelectObject
GetDeviceCaps
AbortDoc
Polyline
EndDoc
StartPage
DeleteDC
SetBkMode
EndPage
DeleteObject
GetCurrentObject
winspool.drv
ClosePrinter
comdlg32
CommDlgExtendedError
ole32
CoCreateInstance
CoUninitialize
CoRegisterMessageFilter
CoInitializeEx
CreateBindCtx
oleaut32
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayRedim
SafeArrayCopy
VariantInit
VariantChangeType
SysAllocString
VariantCopy
VariantClear
SafeArrayDestroy
xprt5
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?CompareNormal@TBstr@XPRT@@QBEHPBG@Z
?AddTail@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
?RemoveHead@TPtrList@XPRT@@QAEPAXXZ
??0TPtrList@XPRT@@QAE@H@Z
??1TPtrList@XPRT@@QAE@XZ
_XprtAtomicIncrement@4
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
xprt_strcmp
xprt_memmove
_XprtMemAlloc@4
_XprtAtomicDecrement@4
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?Lock@TSpinLock@XPRT@@QAEXXZ
?Unlock@TSpinLock@XPRT@@QAEXXZ
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
xprt_iswdigit
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?GetAt@TBstr@XPRT@@QBEGH@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
_XprtInitialize@8
_XprtUninitialize@0
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?Copy@TBstr@XPRT@@QBEPAGXZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
_XprtCreateThread@8
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??0TBstr@XPRT@@QAE@XZ
kSystemEncoding
??0TBstr@XPRT@@QAE@PBDPBG@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
??1TBstr@XPRT@@QAE@XZ
?Compare@TBstr@XPRT@@QBEHPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
?Normalize@TBstr@XPRT@@QAEAAV12@XZ
_XprtGenerateRandom@8
_XprtMemFree@4
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
??0TBstr@XPRT@@QAE@PBG@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
xprt_memset
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
msvcrt
??2@YAPAXI@Z
_adjust_fdiv
_initterm
_onexit
__dllonexit
??3@YAXPAX@Z
malloc
_except_handler3
_purecall
qsort
strcmp
_snwprintf
wcstok
free
memcpy
towupper
isspace
wcslen
swprintf
wcscmp
swscanf
memset
tolower
isupper
Exports
Exports
EEGetModuleInterop
Sections
.text Size: 80KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE