E:\mobileleader\PCSync\PC Side\PCSync_SamsungMAPI12\_ReleaseL\MgrLogFile\MgrLogFile.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a41468cb105282de2ab12e075ae36de9_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a41468cb105282de2ab12e075ae36de9_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a41468cb105282de2ab12e075ae36de9_JaffaCakes118
-
Size
197KB
-
MD5
a41468cb105282de2ab12e075ae36de9
-
SHA1
8ddc0299f4648288425e59da2a939d6c78c20f14
-
SHA256
805cfe0a070b6dede5128438b304da70e84116f45691134b05729e154d85ae59
-
SHA512
8aac91ab10cc3a6190c73bec6c3f1fdf9d3a15f78c5197733595fe92e4085f5476f561bf25d82522327084332615211cc9b21fbed1a7937a4b0e48d6c9526b4b
-
SSDEEP
3072:SjbxlVxVq+eEfftySI3AY1QayvwxjJBLiuw2do8LUTncp9lsZzikC/bpijhx:SPxl3w6XtrOt5Jxfw2dHLUIpDCzi5ijP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a41468cb105282de2ab12e075ae36de9_JaffaCakes118
Files
-
a41468cb105282de2ab12e075ae36de9_JaffaCakes118.dll windows:4 windows x86 arch:x86
ec741b021bc4394c43cccbe8839eb36c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
mgrconfig
?GetChangeLogFilePathW@CConfigA@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetLogFilePathW@CConfigA@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
mfc71lu
ord2311
ord967
ord1000
ord968
ord1001
ord3290
ord531
ord5455
ord5477
ord1472
ord310
ord5433
ord2895
ord2926
ord4078
ord283
ord1443
ord6306
ord744
ord5091
ord556
ord280
ord265
ord762
ord1168
ord371
ord1093
ord384
ord870
ord5083
ord1430
ord629
ord266
ord577
ord293
ord3249
ord723
ord781
ord297
ord578
ord783
ord1086
ord764
ord1176
ord290
ord1079
mslur71
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
__security_error_handler
memset
_wfopen
fprintf
fclose
free
__CxxFrameHandler
_except_handler3
kernel32
GetVersionExA
InitializeCriticalSection
DeleteCriticalSection
WritePrivateProfileStringW
DeleteFileW
MultiByteToWideChar
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
user32
SendMessageW
oleaut32
VariantTimeToSystemTime
Exports
Exports
??0?$CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAE@H@Z
??0?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAE@H@Z
??0CLogData@@QAE@XZ
??0CLogFile@@QAE@XZ
??0CSyncItemA@@QAE@XZ
??0EMailFolder@@QAE@ABV0@@Z
??0EMailFolder@@QAE@XZ
??0EMailFolderList@@QAE@XZ
??1?$CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@UAE@XZ
??1?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@UAE@XZ
??1CLogData@@UAE@XZ
??1CLogFile@@UAE@XZ
??1CSyncItemA@@UAE@XZ
??1EMailFolder@@QAE@XZ
??1EMailFolderList@@UAE@XZ
??4EMailFolder@@QAEAAV0@ABV0@@Z
??_7?$CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@6B@
??_7?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@6B@
??_7CLogData@@6B@
??_7CLogFile@@6B@
??_7CSyncItemA@@6B@
??_7EMailFolderList@@6B@
??_F?$CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAEXXZ
??_F?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAEXXZ
?AddHead@?$CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAEPAU__POSITION@@PAVEMailFolder@@@Z
?AddHead@?$CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAEXPAV1@@Z
?AddPercent@CLogFile@@SAPADPAD@Z
?AddTail@?$CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAEPAU__POSITION@@PAVEMailFolder@@@Z
?AddTail@?$CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAEXPAV1@@Z
?CreateLogFile@CLogData@@SAHXZ
?GetAt@?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAEAAPAVEMailFolder@@PAU__POSITION@@@Z
?GetAt@?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QBEPAVEMailFolder@@PAU__POSITION@@@Z
?GetHead@?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAEAAPAVEMailFolder@@XZ
?GetHead@?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QBEPAVEMailFolder@@XZ
?GetNext@?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAEAAPAVEMailFolder@@AAPAU__POSITION@@@Z
?GetNext@?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QBEPAVEMailFolder@@AAPAU__POSITION@@@Z
?GetPrev@?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAEAAPAVEMailFolder@@AAPAU__POSITION@@@Z
?GetPrev@?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QBEPAVEMailFolder@@AAPAU__POSITION@@@Z
?GetTail@?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAEAAPAVEMailFolder@@XZ
?GetTail@?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QBEPAVEMailFolder@@XZ
?Init@EMailFolder@@QAEXXZ
?InitLogFile@CLogFile@@QAEHXZ
?ItemCount@CLogData@@QAE_NHHH_N@Z
?RemoveHead@?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAEPAVEMailFolder@@XZ
?RemoveTail@?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAEPAVEMailFolder@@XZ
?SaveAllLog@CLogData@@QAE_NXZ
?SetAt@?$_CTypedPtrList@VCPtrList@@PAVEMailFolder@@@@QAEXPAU__POSITION@@PAVEMailFolder@@@Z
?SetMemoSupport@CConfigA@@QAEXH@Z
?SetSyncEndTime@CLogData@@QAEXAAVCOleDateTime@ATL@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@3@@Z
?WriteLogData@CLogFile@@SA_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?WriteLogDataA@CLogFile@@SA_NPAD@Z
?WriteLogDataSyncItem@CLogFile@@SA_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 171KB - Virtual size: 172KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE