e:\src\rjrmxpln\rel32\rjrmxpln.pdb
Static task
static1
Behavioral task
behavioral1
Sample
837a7e0f1109bbe16fc7f19bd29b17bf_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
837a7e0f1109bbe16fc7f19bd29b17bf_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
837a7e0f1109bbe16fc7f19bd29b17bf_JaffaCakes118
-
Size
108KB
-
MD5
837a7e0f1109bbe16fc7f19bd29b17bf
-
SHA1
daf766122626b21cac6e471e14e783084dff1b31
-
SHA256
62a134a40ddff7dce600e4e4b34cb74a42c83df601daa921d0213dca4850c5a8
-
SHA512
78586e2e3b87f927b3ea875a74188932add7a2bea3ba4982efeaa5d84eb074b5b717ef54ec3b1f53e7bfc88bb60783391f80327d177bc1304ba18751c1758e1d
-
SSDEEP
3072:/lr69rw2bJ3AeYm8MWpH3wv/Q3eqE/QiekR6Fbkyo:/lGrw2FnmpH3wnQOv/QaR6JJo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 837a7e0f1109bbe16fc7f19bd29b17bf_JaffaCakes118
Files
-
837a7e0f1109bbe16fc7f19bd29b17bf_JaffaCakes118.dll windows:4 windows x86 arch:x86
e1c3d5d63be1fe469399336af68c50b7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SetEndOfFile
SetFilePointer
CreateFileA
OutputDebugStringA
GetLastError
CreateMutexA
CloseHandle
WaitForSingleObject
GetTickCount
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetTempPathA
GetTempFileNameA
InterlockedDecrement
ReleaseMutex
InterlockedIncrement
ExitProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
advapi32
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegSetValueExA
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
msvcr71
strncpy
??2@YAPAXI@Z
fwrite
fread
??3@YAXPAX@Z
fopen
fclose
strftime
gmtime
time
_fsopen
rename
remove
ftell
strstr
_strlwr
_splitpath
strncmp
_stat
rand
srand
fflush
sscanf
sprintf
__security_error_handler
_except_handler3
free
_initterm
malloc
_adjust_fdiv
__CppXcptFilter
__dllonexit
_onexit
_stricmp
fseek
_strcmpi
Exports
Exports
??0CDataSource@@QAE@XZ
??0CFileRead@@QAE@XZ
??0CFileWrite@@QAE@XZ
??0CRMXHeader@@QAE@XZ
??0NameValuePropertyEx@@QAE@XZ
??0RMXHeader@@QAE@XZ
??0TableOfContentsEntry@@QAE@XZ
??1CDataSource@@QAE@XZ
??1CFileRead@@QAE@XZ
??1CFileWrite@@QAE@XZ
??1CRMXHeader@@QAE@XZ
??1NameValuePropertyEx@@QAE@XZ
??1RMXHeader@@QAE@XZ
??1TableOfContentsEntry@@QAE@XZ
??4CDataSource@@QAEAAV0@ABV0@@Z
??4CFileRead@@QAEAAV0@ABV0@@Z
??4CFileWrite@@QAEAAV0@ABV0@@Z
??4CRMXHeader@@QAEAAV0@AAV0@@Z
??4NameValuePropertyEx@@QAEAAV0@AAV0@@Z
??4RMXHeader@@QAEAAV0@AAV0@@Z
??4TableOfContentsEntry@@QAEAAV0@AAV0@@Z
?AppendEmptyProp@CRMXHeader@@AAEPAVNameValuePropertyEx@@K@Z
?AppendTOCEntry@CRMXHeader@@AAEPAVTableOfContentsEntry@@XZ
?ClearHeader@CRMXHeader@@QAEXXZ
?CloseRead@CFileRead@@QAEJXZ
?CloseWrite@CFileWrite@@QAEJXZ
?CreateNewTOCEntry@CRMXHeader@@QAEJKGPAKKPAU_SDecryptionData@@@Z
?CreateSecurityInstance@@YGJW4PKI_BCYPHER_TYPE@@PAPAUIRMASecurity@@@Z
?CreateTimesPlayedIndex@CRMXHeader@@AAEJPAK0PAG@Z
?DeleteProp@CRMXHeader@@QAEJKPBD@Z
?DeleteTOCEntry@CRMXHeader@@QAEJK@Z
?EncryptTimeoutData@CRMXHeader@@AAEJGPAE0PAKPAPAU_SDecryptionData@@@Z
?ExportSessionKey@CFileWrite@@AAEJPAEKPAPAEPAK@Z
?FindProp@CRMXHeader@@AAEPAVNameValuePropertyEx@@KPBD@Z
?FixupTimesPlayed@CRMXHeader@@QAEXK@Z
?FreeDecryptionData@@YGXPAU_SDecryptionData@@@Z
?GenerateSessionKeyFromKeyPair@CFileRead@@AAEJKPAEK0PAKPAPAE@Z
?GetDecryptionData@CRMXHeader@@QAEJKPAKPAPAU_SDecryptionData@@_N2@Z
?GetFileVersion@CRMXHeader@@QAEKXZ
?GetHeaderSize@CRMXHeader@@QAEKXZ
?GetObjectVersion@CRMXHeader@@QAEGXZ
?GetSecurity@CFileWrite@@QAEPAUIRMASecurity@@XZ
?GetTOCDataSize@CRMXHeader@@QAEKK@Z
?GetTOCEntries@CRMXHeader@@QAEKXZ
?GetTOCFlags@CRMXHeader@@QAEGK@Z
?GetTOCOffset@CRMXHeader@@QAEKK@Z
?GetTOCPropBlob@CRMXHeader@@QAEJKPBDPAGPAPAE@Z
?GetTOCPropLong@CRMXHeader@@QAEJKPBDPAK@Z
?GetTOCPropString@CRMXHeader@@QAEJKPBDPAPAD@Z
?GetTimeoutData@CRMXHeader@@AAEJKPAGPAPAE@Z
?GetTimesPlayed@CRMXHeader@@QAEJKKGPAGH@Z
?GetTimesPlayedFile@CRMXHeader@@AAEJPADPAPAU_iobuf@@@Z
?HasTimeoutInfo@CRMXHeader@@QAE_NK@Z
?InitRead@CFileRead@@AAEJ_NKPAU_SDecryptionData@@KPAE0@Z
?InitRead@CFileRead@@QAEJ_NKPAU_SDecryptionData@@KPAE@Z
?InitWrite@CFileWrite@@QAEJ_NPAKPAPAU_SDecryptionData@@0KPAE@Z
?IsTOCDataEncrypted@CRMXHeader@@QAE_NK@Z
?LoadHeaderFromBuffer@CRMXHeader@@QAEJPAEKPAK@Z
?LoadHeaderFromFile@CRMXHeader@@QAEJXZ
?LoadHeaderFromHeader@CRMXHeader@@QAEJPAV1@@Z
?LoadSecurityDll@@YGPAUHINSTANCE__@@XZ
?MakeValid@CRMXHeader@@AAEJPAD@Z
?OpenTimesPlayedFile@CRMXHeader@@AAEJPADPAPAU_iobuf@@@Z
?PackTimeoutData@CRMXHeader@@AAEJKPAU_SDecryptionData@@KKGGPBD1PAGPAPAE@Z
?Read@CDataSource@@QAEKPAEKK@Z
?Read@CFileRead@@QAEJPAEKPAK@Z
?Reset@CFileRead@@AAEXXZ
?Reset@CFileWrite@@AAEXXZ
?Reset@NameValuePropertyEx@@QAEXXZ
?Reset@RMXHeader@@QAEXXZ
?Reset@TableOfContentsEntry@@QAEXXZ
?Seek@CDataSource@@QAEHJH@Z
?Seek@CFileRead@@QAEJKG@Z
?Seek@CFileWrite@@QAEJKG@Z
?SetRange@CFileRead@@QAEJKK@Z
?SetTOCFlags@CRMXHeader@@QAEJKG@Z
?SetTOCOffset@CRMXHeader@@QAEJKK@Z
?SetTOCPropBlob@CRMXHeader@@QAEJKPBDGPAE_N@Z
?SetTOCPropLong@CRMXHeader@@QAEJKPBDK_N@Z
?SetTOCPropString@CRMXHeader@@QAEJKPBD0_N@Z
?SetTimeoutProp@CRMXHeader@@QAEJKKKGPBD0@Z
?Tell@CDataSource@@QAEKXZ
?Tell@CFileRead@@QAEKXZ
?Tell@CFileWrite@@QAEKXZ
?UnpackTimeoutData@CRMXHeader@@QAEJKPAKPAPAU_SDecryptionData@@00PAG2PAPAD3@Z
?Use@CDataSource@@QAEXPAU_iobuf@@@Z
?Use@CRMXHeader@@QAEXPAU_iobuf@@@Z
?UseBuffer@CDataSource@@QAEXPAEK@Z
?ValidateTimeoutInfoVersion@CRMXHeader@@QAEJK@Z
?Write@CDataSource@@QAEJPAEK@Z
?Write@CFileWrite@@QAEJPAEK@Z
?WriteHeaderToFile@CRMXHeader@@QAEJXZ
?get_blob_property@NameValuePropertyEx@@QAEJPAGPAPAE@Z
?get_blob_property@TableOfContentsEntry@@QAEJPBDPAGPAPAE@Z
?get_long_property@NameValuePropertyEx@@QAEJPAK@Z
?get_long_property@TableOfContentsEntry@@QAEJPBDPAK@Z
?get_string_property@NameValuePropertyEx@@QAEJPAPAD@Z
?get_string_property@TableOfContentsEntry@@QAEJPBDPAPAD@Z
?pack@NameValuePropertyEx@@QAEPAEPAEAAK@Z
?pack@RMXHeader@@QAEPAEPAEAAK@Z
?pack@TableOfContentsEntry@@QAEPAEPAEAAK@Z
?persist_size@NameValuePropertyEx@@QAE?BKXZ
?persist_size@RMXHeader@@QAE?BKXZ
?persist_size@TableOfContentsEntry@@QAE?BKXZ
?set_blob_property@NameValuePropertyEx@@QAEJPBDGPAE@Z
?set_long_property@NameValuePropertyEx@@QAEJPBDK@Z
?set_string_property@NameValuePropertyEx@@QAEJPBD0@Z
?static_size@NameValuePropertyEx@@QAE?BKXZ
?static_size@RMXHeader@@QAE?BKXZ
?static_size@TableOfContentsEntry@@QAE?BKXZ
?unpack@NameValuePropertyEx@@QAEPAEPAEK@Z
?unpack@RMXHeader@@QAEPAEPAEK@Z
?unpack@TableOfContentsEntry@@QAEPAEPAEK@Z
MPACreateComponentInstance
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 63KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE