e:\jenkins\workspace\Win-PCSuite\Output\PDB\Release\GetConnected.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a51063bd0602a5a0dfbb3065ee435fd9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a51063bd0602a5a0dfbb3065ee435fd9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a51063bd0602a5a0dfbb3065ee435fd9_JaffaCakes118
-
Size
346KB
-
MD5
a51063bd0602a5a0dfbb3065ee435fd9
-
SHA1
5555d5d505cff13097c791655649e5360492dba0
-
SHA256
5c2057172d3274783285cfd200a31f00a59e2fd7e0a354e6687cdb7b53fd83c9
-
SHA512
f001fc8a5f586422788f8fc12e5c1faf139057a5a8c794d9fba973e7be54d58e52dec7a69f67e3b1619f8486210e0dfc8f1ff6ed258fe43b3eadd4beb83e5bd7
-
SSDEEP
6144:L17HoFQ4jHVpNABYiyXSP8IGlsJOZs781TmQthsN6c5S4zDy3EWRYFvvOm6F1i7M:1HoFQ4jHVpNABYiyXSPYssZsIVmQthsk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a51063bd0602a5a0dfbb3065ee435fd9_JaffaCakes118
Files
-
a51063bd0602a5a0dfbb3065ee435fd9_JaffaCakes118.exe windows:5 windows x86 arch:x86
5d109176fe844f86f3e1e9624b95a751
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ngscm
?StopAnimation@CPNGAnimation@@QAE_NXZ
?StartAnimation@CPNGAnimation@@QAE_NXZ
?SetTextAlignment@CNbuuStaticCtrl@@QAEXK@Z
?DeleteAnimation@CPNGAnimation@@QAE_NXZ
??1CNBitmapUtil@@QAE@XZ
??1CPNGAnimation@@UAE@XZ
??1CNbuuCheckButtonCtrl@@UAE@XZ
??0CNbuuBarStaticCtrl@@QAE@XZ
??0CNbuuStaticCtrl@@QAE@XZ
??1CNbuuStaticCtrl@@UAE@XZ
??0CNBitmapUtil@@QAE@XZ
??0CNbuuCheckButtonCtrl@@QAE@XZ
??1CPCSL2InfoReader@@QAE@XZ
?SetStartupFrame@CPNGAnimation@@QAE_NH@Z
?SetBitmapHandles@CPNGAnimation@@QAE_NHPAUHBITMAP__@@@Z
?SetAnimationMembers@CPNGAnimation@@QAE_NHHH@Z
?SetDestinationWindow@CPNGAnimation@@QAE_NPAPAUHWND__@@@Z
?SetAnimationCoordinates@CPNGAnimation@@QAEXUtagPOINT@@@Z
?Resize@CNBitmapUtil@@QAEHW4BitmapType@@HHHH@Z
?GetBitmapWidth@CNBitmapUtil@@QAEHW4BitmapType@@@Z
?GetBitmapHeight@CNBitmapUtil@@QAEHW4BitmapType@@@Z
?DeleteBitmap@CNBitmapUtil@@QAEPAUHBITMAP__@@W4BitmapType@@H@Z
?GetBitmapHandle@CNBitmapUtil@@QAEPAUHBITMAP__@@W4BitmapType@@H@Z
?AlphaBlendBitmaps@CNBitmapUtil@@QAEHHHH@Z
?NLoadBitmap@CNBitmapUtil@@QAEPAUHBITMAP__@@PAUHINSTANCE__@@HW4BitmapType@@H@Z
?GetUIManufacturer@CPCSL2InfoReader@@QAEPBGXZ
?ReadPCSL@CPCSL2InfoReader@@QAEHPAG@Z
??0CPCSL2InfoReader@@QAE@XZ
?SetTooltip@CNbuuTooltip@@QAEXPAUHWND__@@PBG@Z
??1CNbuuCommonButtonCtrl@@UAE@XZ
??0CNbuuCommonButtonCtrl@@QAE@XZ
??1CNbuuAniStaticCtrl@@UAE@XZ
?UnloadBitmap@CNbuuResourceManager@@SA_NPAPAVCNbuuBitmap@@@Z
?LoadBitmapW@CNbuuResourceManager@@SA_NPAPAVCNbuuBitmap@@PAUHINSTANCE__@@IHPBG@Z
?m_hInstRes@CNbuuLib@@0PAUHINSTANCE__@@A
?StartAnimation@CNbuuAniStaticCtrl@@QAEXXZ
?Show@CNbuuCommonMessageBox@@SAHPAUHWND__@@PBG1I@Z
?StopAnimation@CNbuuAniStaticCtrl@@QAEXXZ
??0CNbuuAniStaticCtrl@@QAE@XZ
??1CNbuuBarStaticSkin@@UAE@XZ
??1CNbuuAniStaticSkin@@UAE@XZ
??1CNbuuStaticBitmapSkin@@UAE@XZ
?PcsLoadFont@@YAXPAUtagLOGFONTW@@@Z
?m_dwLayout@CNbuuLib@@0KA
??1CRTLHelper@@UAE@XZ
?IsRTL@CRTLHelper@@QAEHXZ
??0CRTLHelper@@QAE@PBG@Z
?GetLangID@CRTLHelper@@SAPAGPAUHKEY__@@PBG1@Z
??1CNbuuStepBarCtrl@@UAE@XZ
??1CNbuuWindowBackgroundSkin@@UAE@XZ
??1CNbuuWindowBackgroundCtrl@@UAE@XZ
?FlipDialog@CRTLHelper@@SAPAUDLGTEMPLATE@@PAUHINSTANCE__@@PBGH@Z
??0CNbuuStepBarCtrl@@QAE@XZ
??0CNbuuWindowBackgroundSkin@@QAE@XZ
??0CNbuuWindowBackgroundCtrl@@QAE@XZ
?SetTextColor@CNbuuStaticCtrl@@QAEXK@Z
?SetDefaultSkinDef@CNbuuBarStaticSkin@@SAXVCNbuuBarStaticSkinDef@@@Z
?Init@CNbuuLib@@SAXPAUHINSTANCE__@@0@Z
??0CNbuuAniStaticSkin@@QAE@XZ
??0CNbuuStaticBitmapSkin@@QAE@XZ
??0CNbuuBarStaticSkin@@QAE@XZ
??0CPNGAnimation@@QAE@XZ
??1CNbuuBarStaticCtrl@@UAE@XZ
shlwapi
PathIsDirectoryW
PathAppendW
PathRemoveFileSpecW
PathFileExistsW
shell32
ShellExecuteW
SHGetSpecialFolderPathW
setupapi
SetupDiClassGuidsFromNameW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
CM_Get_Device_IDW
gdiplus
GdiplusStartup
GdiplusShutdown
mfc90u
ord1064
ord1100
ord2728
ord266
ord6311
ord5008
ord4319
ord524
ord744
ord5182
ord374
ord4448
ord4423
ord6801
ord4173
ord6803
ord2251
ord6035
ord4179
ord6741
ord5830
ord4213
ord2087
ord3217
ord5674
ord5676
ord2447
ord4347
ord4996
ord5680
ord5663
ord6018
ord3115
ord4905
ord4681
ord3670
ord794
ord4967
ord4043
ord265
ord3145
ord6335
ord2360
ord4527
ord4530
ord6604
ord436
ord1688
ord2595
ord1063
ord1248
ord1088
ord799
ord4702
ord376
ord4000
ord3676
ord5653
ord2904
ord6065
ord5632
ord4631
ord5167
ord5324
ord2208
ord1810
ord811
ord3353
ord784
ord1754
ord1751
ord4345
ord1492
ord4664
ord5602
ord2074
ord5512
ord6800
ord4603
ord3743
ord5154
ord1728
ord6466
ord960
ord965
ord969
ord967
ord971
ord2635
ord2619
ord2638
ord2633
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord4174
ord6804
ord3682
ord5404
ord6376
ord3226
ord1442
ord5625
ord2139
ord5650
ord2771
ord2983
ord3112
ord4728
ord2966
ord3140
ord2774
ord2893
ord1250
ord3500
ord4543
ord595
ord5851
ord933
ord278
ord899
ord2478
ord285
ord1607
ord3706
ord3757
ord1603
ord582
ord4130
ord2694
ord2537
ord6013
ord4405
ord1108
ord4747
ord2206
ord1048
ord5548
ord589
ord1183
ord3165
ord1314
ord1313
ord290
ord938
ord935
ord813
ord3220
ord293
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4910
ord4682
ord3515
ord639
ord2069
ord2597
ord2593
ord1144
ord1137
ord801
ord1599
ord280
ord4266
ord3639
ord296
ord6408
ord286
ord4131
ord2676
ord6579
ord5685
ord5683
ord2615
ord2625
ord2623
ord2621
ord2617
ord2640
ord2628
ord1792
ord1791
ord1727
ord600
ord1675
ord1713
ord6636
ord6428
ord2862
ord6259
ord6501
ord6499
ord1156
ord766
ord3355
ord6411
ord1493
ord5664
ord1809
ord3286
ord814
ord1272
msvcr90
__CxxFrameHandler3
memset
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
wcscpy_s
wcscat_s
wcsstr
free
_wcsdup
_wtoi
wcstok_s
swscanf_s
swprintf_s
_wcslwr_s
memcpy_s
wcsncmp
memmove_s
malloc
vswprintf_s
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_except_handler4_common
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_purecall
_crt_debugger_hook
kernel32
GetCurrentDirectoryW
GlobalLock
GlobalAlloc
GlobalFree
GlobalUnlock
LeaveCriticalSection
EnterCriticalSection
PulseEvent
CreateEventW
GetModuleFileNameW
GetACP
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
GetExitCodeThread
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
FindClose
FindFirstFileW
MultiByteToWideChar
ReadFile
FlushFileBuffers
WriteFile
SetCommTimeouts
EscapeCommFunction
SetCurrentDirectoryW
ResetEvent
SetEvent
GetCommState
CreateFileW
OutputDebugStringW
LoadLibraryExW
lstrlenA
CreateDirectoryW
ExpandEnvironmentStringsA
LoadLibraryA
CreateEventA
OpenEventA
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetFullPathNameW
lstrcpyW
CloseHandle
WaitForSingleObject
PurgeComm
CreateThread
ExitThread
GetLastError
HeapFree
GetProcessHeap
lstrlenW
TerminateThread
SetCommState
WaitForMultipleObjects
SetLastError
GetProcAddress
GetModuleHandleW
LoadLibraryW
SetupComm
WideCharToMultiByte
user32
ShowWindow
GetClientRect
SetWindowPos
HideCaret
wsprintfW
GetDesktopWindow
GetWindowLongW
SetWindowLongW
MapWindowPoints
GetSystemMetrics
RedrawWindow
MoveWindow
LoadIconW
IsIconic
DrawIcon
SetProcessDefaultLayout
LoadStringW
SetForegroundWindow
SendMessageW
KillTimer
SetTimer
IsWindowEnabled
LoadCursorW
SetCursor
IsWindow
GetDC
ReleaseDC
SetFocus
GetParent
InvalidateRect
GetDlgItem
PostMessageW
GetWindowRect
EnableWindow
SetWindowTextW
GetFocus
gdi32
TranslateCharsetInfo
CreateFontIndirectW
DeleteObject
GetTextMetricsW
GetStockObject
advapi32
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegCloseKey
RegEnumValueW
comctl32
ImageList_AddMasked
ImageList_Create
ole32
CLSIDFromProgID
OleRun
CoUninitialize
CoCreateInstance
CoInitialize
CLSIDFromString
oleaut32
SysStringByteLen
SetErrorInfo
VariantChangeType
GetErrorInfo
SysAllocString
SysFreeString
SysStringLen
SysAllocStringLen
SafeArrayDestroy
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayPutElement
VariantClear
VariantCopy
VariantInit
CreateErrorInfo
SysAllocStringByteLen
SafeArrayCreate
SafeArrayRedim
msvcp90
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHPBG@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
Sections
.text Size: 189KB - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.drdata Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE