K:\oIelJTzLo\scxhgfeeUdgq\cekveje.pdb
Static task
static1
Behavioral task
behavioral1
Sample
879c6bc3d47114bc10c5025989d0a186_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
879c6bc3d47114bc10c5025989d0a186_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
879c6bc3d47114bc10c5025989d0a186_JaffaCakes118
-
Size
1.3MB
-
MD5
879c6bc3d47114bc10c5025989d0a186
-
SHA1
ff150e0497601c52c899c9de15cf1691046e5c4d
-
SHA256
ca87535184390778305cdcddba04c99c6598951eb25dac80ac649eba8874eda8
-
SHA512
e4af6e1b7a45f438ee4d54598820ac510c4fe4afbe05aac56a269c2aa9760defd3c08cd4a67034d7db7e6872f7e333f475bcd8619db915174da3c4ef05bfc10e
-
SSDEEP
3072:a/o+O5t4BrBhhOObydBRTJd4RaogkW9vR6OatEBY6BXhZDDd29K85:ZV5u6dsNgpQqhB0v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 879c6bc3d47114bc10c5025989d0a186_JaffaCakes118
Files
-
879c6bc3d47114bc10c5025989d0a186_JaffaCakes118.dll windows:5 windows x86 arch:x86
99563621ffa8ae747e8173601d630a75
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
shlwapi
PathRemoveBlanksW
IntlStrEqWorkerA
StrToIntW
StrToInt64ExA
ChrCmpIA
msvcrt
_controlfp
__set_app_type
wcstombs
__p__fmode
fread
__p__commode
_amsg_exit
wcscat
isalnum
_initterm
_acmdln
exit
isdigit
_ismbblead
gets
isalpha
wcsstr
_XcptFilter
wcspbrk
_exit
wcstoul
_cexit
putchar
__setusermatherr
__getmainargs
printf
gdi32
StartPage
GetTextColor
SetWindowOrgEx
SetLayout
GetClipBox
SetBrushOrgEx
UnrealizeObject
CreateBitmapIndirect
ScaleWindowExtEx
EnumFontFamiliesExW
RoundRect
StartDocW
CreateCompatibleDC
CreateEllipticRgnIndirect
ScaleViewportExtEx
GetTextExtentPointA
SelectClipRgn
GetStockObject
user32
HiliteMenuItem
FindWindowA
CharNextExA
InsertMenuA
SetUserObjectInformationW
MapVirtualKeyExW
CharUpperBuffW
CreateDialogParamW
GetClassInfoExW
DestroyIcon
GetMenuItemID
GetMenuCheckMarkDimensions
RemoveMenu
LoadImageA
CheckMenuItem
GetUpdateRgn
GetMessagePos
EnumChildWindows
InvalidateRect
SetClassLongW
CharNextW
IsCharAlphaW
LoadCursorA
ActivateKeyboardLayout
DrawStateW
OemToCharA
LoadAcceleratorsA
SystemParametersInfoA
InvalidateRgn
CreateIconIndirect
TranslateMessage
DialogBoxParamW
VkKeyScanW
GetClassInfoExA
FrameRect
SetPropW
CascadeWindows
SendMessageA
TrackPopupMenuEx
GetClassNameW
AdjustWindowRect
ShowScrollBar
kernel32
lstrcpynW
LeaveCriticalSection
GlobalMemoryStatus
GetShortPathNameW
GetFileAttributesExA
RegisterWaitForSingleObject
FindClose
QueryDosDeviceW
GetLocalTime
GetVersionExA
ReadFile
FindResourceA
FileTimeToLocalFileTime
SetEndOfFile
FlushFileBuffers
GlobalGetAtomNameW
GetFileType
DuplicateHandle
ExitProcess
GetModuleFileNameW
VerifyVersionInfoW
Exports
Exports
?CopyDateW@@YGIM&U
?IncrementPathNew@@YGGDFJ&U
?GenerateScreenExA@@YGPAEME&U
?KillStringOriginal@@YGPAMPA_ND&U
?PutMutantW@@YGXFJ&U
?RemoveMemoryExA@@YGEJPAMPAJ&U
?GeneratePointerExA@@YGPAGPADF&U
?GetTextA@@YGGE&U
?IsNotPointerW@@YGXHPAJ&U
?CancelMonitor@@YGNPANN&U
?DecrementFilePathW@@YGGGJ&U
?ComponentEx@@YGGMPAE&U
?IsValidCommandLineEx@@YGMI&U
?AddHeightEx@@YGPAXGI&U
?SetDeviceOld@@YGPANPAEPAJ&U
?PutProfileExA@@YGM_N&U
?EnumConfigExW@@YGXMEPAFI&U
?InvalidateDialogExA@@YGPAMEEEE&U
?InstallTextEx@@YGPAXPAMIPAEPAG&U
?AddListItemNew@@YGFPAIPAG&U
?FindTaskExA@@YGPAE_NGH&U
?CrtMessageA@@YGMMPADJPAJ&U
?SetModuleA@@YGFPAH&U
?OnExpressionNew@@YGXEPAH&U
?ModifyMonitorW@@YG_NFK_NF&U
?IsName@@YGPAKDHPAM&U
?GlobalMutantW@@YGPAGJGM&U
?FreeFunctionW@@YGDMPAFHI&U
?DecrementExpressionW@@YGIPAMIF&U
?EnumDateA@@YGXDPAD_N&U
?InsertObjectOriginal@@YGXPAMPADPAM&U
?IsNotTimeExW@@YG_NKGMM&U
?CloseProfileOld@@YGEPAF&U
?DeleteHeightNew@@YG_NKPAEK&U
?CloseFolderNew@@YGPADK&U
?GlobalDeviceW@@YGGPAKDPAMI&U
?ValidateDateTimeOld@@YGFHEM&U
?DecrementKeyNameW@@YGPAXDPAFDPAD&U
?ShowFolderA@@YGPAFPAIH&U
RunAs
?PutSemaphoreOld@@YGX_N&U
?SendMonitorEx@@YGFFPAI&U
?CloseSemaphoreExA@@YGPAXJPAD&U
?LoadStringW@@YGPADPAEPAG&U
?SendSemaphoreA@@YGGGDI&U
?GeneratePointerNew@@YGKEPAKHE&U
?InvalidateMonitorW@@YGPAKPADH&U
?IsNotEventExA@@YGINGPAHM&U
?IncrementMessageA@@YGGHM&U
?CloseExpressionOld@@YG_NPAF&U
?IncrementConfigOld@@YGGDJKPAF&U
SensNotifyNetconEvent
?FormatDeviceOriginal@@YGJGPANPAI&U
?RemoveSemaphoreA@@YGGPAD&U
?FormatWindowInfoNew@@YGPAXIJHM&U
?SendMutantOriginal@@YGMMKJJ&U
?ShowClassA@@YGPAEPAEH&U
?CallFolderExW@@YGNJ&U
?CopyWindowInfoOld@@YGDPA_NKHH&U
?IncrementNameOriginal@@YG_NPAJPAI&U
?ValidateRectNew@@YGPAGEFPAH&U
?IsNotScreenW@@YGKPAFGK&U
?DecrementSemaphoreOld@@YGPAKF&U
?GlobalTextW@@YGXPAFFHPAJ&U
?RemoveWidthEx@@YGFPAK&U
?IsProcessOriginal@@YGFDEHH&U
?LoadThreadOriginal@@YGXPAK&U
?DeleteDeviceOld@@YGPAXJ&U
?EnumMemoryW@@YGPAXJ&U
?ModifyAppNameExW@@YGPAXPA_NGG&U
?FreeClassW@@YGPAHDGF&U
?DecrementPenEx@@YGJPAN&U
?CancelTimeExA@@YGPAXPAMN&U
?SetProviderOld@@YGDD_N&U
?IncrementObjectEx@@YGED&U
?HeightOriginal@@YGPAJPAFHK&U
?ShowDirectoryExW@@YGMKN_N&U
?HideDialogNew@@YGEMPANPAMPAF&U
?FormatFolderExW@@YGEIIPAE&U
?CancelProcessOriginal@@YGPAKPADDKJ&U
?ModifyFullNameExA@@YGEMKJ&U
SensNotifyRasEvent
?SetRectEx@@YGPAGPADPAG&U
?AddProfileA@@YGHE&U
?ShowDateTimeOriginal@@YGGMJ&U
?IncrementDateTimeW@@YGGPAEK_NPAJ&U
?InsertDeviceW@@YGMPAKPAJH&U
SensNotifyWinlogonEvent
?SendClassA@@YGMMMJ&U
?FindEventEx@@YGXGED&U
?PutSystemA@@YGPAGFPADJ&U
?SendPointExA@@YGXF&U
?InvalidateDateEx@@YGGEJID&U
?CrtKeyNameEx@@YGPAEIPADG&U
?CancelSizeExW@@YGPAXHPAK&U
?ShowDevice@@YGEPAM&U
?ShowStateW@@YGEPAEJFI&U
?FormatSemaphoreW@@YGXPAEG&U
?IsNotCommandLineExA@@YGPAMJJFPAF&U
?SetEventExA@@YGXFINH&U
?HideStateNew@@YGPAGJPAG&U
?CallTimerA@@YGNNN&U
?AddTimeExW@@YGDPAEM&U
?RemoveHeightA@@YGXI&U
ServiceMain
?GetExpressionOld@@YGPAEPAE&U
?InvalidateList@@YGDDIH&U
?GenerateTimeExA@@YGPAEJPAN&U
?KillOption@@YGPAX_NJ&U
?InsertWidthA@@YGNJIH&U
?EnumClassOriginal@@YGKEJPAFD&U
?CloseConfigOriginal@@YGDE&U
?InsertClass@@YGMDG&U
?DecrementMessageA@@YGIPA_N&U
?FunctionW@@YGPAIGMPAFPA_N&U
?PutFile@@YGIDK&U
?InstallHeaderOld@@YGPAHKKEF&U
?InstallAnchor@@YGPAXIJ&U
?PutTextW@@YG_NPAFHKPAF&U
?GenerateDataExA@@YGFHJIH&U
?FreeDataEx@@YGHKKPAD&U
?CrtTimerW@@YGPAMMJFPAH&U
?InsertKeyboard@@YGHJDF&U
?ValidateFunctionEx@@YGXFPA_NHPAJ&U
?RtlObjectExW@@YGPAJD&U
StartAs
?EnumVersionNew@@YGKEPAG&U
��H�B
?InsertMainStructDlhSi@@YGKGH@Z
?CloseFullNameW@@YGPAEDGPAGF&U
?EnumExpressionOld@@YGMPANPAMPAF&U
?PutValue@@YG_NJME&U
?InvalidateOptionExA@@YGPAGPAK&U
?SendClassExA@@YGPAMPAK&U
?OnFullNameOld@@YGFPANPAE&U
?InsertScreenW@@YGIPAJGH&U
?RtlTimerW@@YGJIDPAI&U
?EnumListNew@@YGPAH_NPAD&U
?OnProjectNew@@YGPAJPADDHD&U
?RemoveProfileEx@@YGPAHM&U
?FindListItemOld@@YGPADM_N&U
?IsPointer@@YGKPAEK&U
?FreeSizeA@@YGDK&U
?IsDateTimeEx@@YGPADFPA_NPAE&U
?IsValidKeyNameExA@@YGGIDHG&U
?IsValidDateEx@@YGHGM&U
?IncrementDataW@@YGXPAIFE&U
?IncrementCommandLineEx@@YGKPAEI&U
?DecrementPoint@@YGPANEEPAND&U
?ShowSystemOriginal@@YGMPAJ&U
?CloseSizeExA@@YGPAFFGPAHE&U
?SendMonitor@@YGFJPAJKPAD&U
?DecrementTimerExW@@YGJPAIDD&U
?FindDateExA@@YGXPAF&U
?ModifyCharExW@@YGPAFPAD&U
?PutDateTimeW@@YGPAED&U
?ModifyHeightOriginal@@YG_NMPAFGH&U
?FindHeaderExW@@YGKPAKPADH&U
?CloseSemaphoreOriginal@@YGXPADEKPAK&U
?InstallKeyboard@@YGKPANDI&U
?IsValidPointExA@@YGJN&U
?CancelStateEx@@YGDNMI&U
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rimp Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.redt Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdbg1 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rit Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdbg2 Size: 512B - Virtual size: 62B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rvar Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rpt Size: 1024B - Virtual size: 650B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hdata Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ping Size: - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ