c:\DailyBuild\sources\Nero7_OCTANE_RELEASE\Nero\bin\Release\newtrf.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a749d46b5daf9e08dfa44f1e5add1dd3_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a749d46b5daf9e08dfa44f1e5add1dd3_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a749d46b5daf9e08dfa44f1e5add1dd3_JaffaCakes118
-
Size
296KB
-
MD5
a749d46b5daf9e08dfa44f1e5add1dd3
-
SHA1
3b76fbd62195eda57f5077780c227b83c9895daf
-
SHA256
54c60b0bcb72daf3e9bc48b509c97a2ea6dd98a87e9578a4b7ecc2130b8c2aa3
-
SHA512
d06fc918665c14e2fc3f1657e3ffef6ea3efe27d638d02b73ff7efa3eac62d8529b41bd3110483ddf83dd93c0b15c37cbb51c196ace4f4bc41b0f1025d3831fa
-
SSDEEP
6144:RbuolPSN5uiIxKt1j7Z5MMFlUq6Dx5HvstcFYSZYtA:RCbuiIAtBZqMoT7pYtA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a749d46b5daf9e08dfa44f1e5add1dd3_JaffaCakes118
Files
-
a749d46b5daf9e08dfa44f1e5add1dd3_JaffaCakes118.dll windows:4 windows x86 arch:x86
c1de5b21bf8fd7eab5ee61ac3b5a9bf3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LoadLibraryA
VirtualAlloc
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
CreateSemaphoreW
FreeLibrary
GetProcAddress
GetLastError
GetCurrentThreadId
MulDiv
FormatMessageW
CloseHandle
WaitForSingleObject
LoadLibraryW
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
ExitProcess
LocalFree
WideCharToMultiByte
MultiByteToWideChar
GetSystemDefaultLangID
GetVersion
GlobalMemoryStatus
DisableThreadLibraryCalls
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyW
uneroerr
?Fatal@CNeroError@@UBEHXZ
?GetTime@CNeroError@@UBEJXZ
?GetDescriptionLine@CNeroError@@UBEHHHPAGH_N@Z
?GetDescriptionLine@CNeroError@@UBEHHHPAGH@Z
??0CErrorClone@@QAE@ABV0@@Z
??0CNeroError@@IAE@PBGHH@Z
?ERRAdd@@YAABVINeroError@@ABV1@@Z
??0WorkerThread@@QAE@PAX@Z
?StartThread@WorkerThread@@UAEHK@Z
??1WorkerThread@@UAE@XZ
?DestroyErrorList@@YAXK@Z
?CopyErrorsTo@CNeroErrorList@@QBEXAAV1@PAVErrorListPos@@1@Z
?GetNeroErrorList@@YAAAVCNeroErrorList@@K@Z
?ERRMyList@@YAAAVCNeroErrorList@@XZ
?WaitForThreadEnd@WorkerThread@@QAEKKPAUHWND__@@@Z
?SetProcessPriority@@YAHW4ePriorityClass@@@Z
?GetNeroPortab@@YAAAVCNeroPortab@@XZ
?CreateNeroSemaphore@@YAPAVCAbstractSemaphore@@J@Z
?IsWindows2kOrHigher@@YAHXZ
?GetNext@CNeroErrorList@@QBE?AVErrorListPos@@ABV2@@Z
?GetError@CNeroErrorList@@QBEHAAVCErrorClone@@ABVErrorListPos@@@Z
??0CErrorClone@@QAE@XZ
?GetFirst@CNeroErrorList@@QBE?AVErrorListPos@@XZ
??0CNeroErrorList@@QAE@XZ
?Rollback@CNeroErrorList@@QAEXABVErrorListPos@@@Z
?GetLast@CNeroError@@SA?AVErrorListPos@@XZ
?MyNeroThread@@YAAAVCAbstractThread@@XZ
?GetLast@CNeroErrorList@@QBE?AVErrorListPos@@XZ
?CreateNeroThread@@YAPAVCAbstractThread@@XZ
?MoveErrorsTo@CNeroErrorList@@QAEXAAV1@@Z
?UnRegisterWorkerThread@@YAXPAVWorkerThread@@@Z
?RegisterWorkerThread@@YAXPAVWorkerThread@@@Z
?SetFatal@CNeroError@@UAEHH@Z
?GetError@CNeroError@@UBEHXZ
?GetErrorFile@CNeroError@@UBEPBGXZ
?GetLine@CNeroError@@UBEHXZ
?EnableMessageTranslation@CNeroError@@UAEXH@Z
?IsMessageTranslationEnabled@CNeroError@@UBEHXZ
?GetThreadName@CNeroError@@UBEPBGXZ
?GetDescriptionLine@CNeroError@@UBEHHPAGH@Z
??1CErrorClone@@UAE@XZ
??1CNeroErrorList@@UAE@XZ
??1CNeroError@@UAE@XZ
?GetErrorIcon@CNeroError@@UBE?AW4NeroErrorID@@XZ
msvcp71
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?_Nomemory@std@@YAXXZ
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?is@?$ctype@G@std@@QBE_NFG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1locale@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?clear@ios_base@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
?_Register@facet@locale@std@@QAEXXZ
?_Incref@facet@locale@std@@QAEXXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
??Bid@locale@std@@QAEIXZ
?id@?$ctype@D@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@@Z
?id@?$ctype@G@std@@2V0locale@2@A
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
msvcr71
??0exception@@QAE@ABV0@@Z
__CppXcptFilter
_adjust_fdiv
_initterm
_onexit
__dllonexit
__security_error_handler
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_callnewh
strlen
_getmbcp
wcscpy
wcscat
_vsnwprintf
_snwprintf
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
swprintf
malloc
strncpy
free
wcschr
wcslen
wcsncpy
_wcsdup
memmove
memcmp
_CxxThrowException
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
div
memset
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__CxxFrameHandler
??3@YAXPAX@Z
_purecall
??_V@YAXPAX@Z
memcpy
Exports
Exports
??0CNeroError@@QAE@ABV0@@Z
??0CNeroErrorList@@AAE@ABV0@@Z
??0INeroError@@QAE@ABV0@@Z
??0INeroError@@QAE@XZ
??1INeroError@@UAE@XZ
??4CNeroError@@QAEAAV0@ABV0@@Z
??4CNeroErrorList@@QAEAAV0@ABV0@@Z
??4INeroError@@QAEAAV0@ABV0@@Z
??_7CNeroError@@6B@
??_7CNeroErrorList@@6B@
??_7INeroError@@6B@
??_FWorkerThread@@QAEXXZ
?ByteSwap2352@@YAXPAE@Z
?CalcSubChannelCRC@@YAGPBEK@Z
?CheckECCAndEDC_Mode1@@YAHQAEH@Z
?CheckECCAndEDC_Mode2Form1@@YAHQAEH@Z
?CheckECCAndEDC_Mode2Form1_2336@@YAHQAEH@Z
?CheckECCAndEDC_Mode2Form2@@YAHQAEH@Z
?CheckECCAndEDC_Mode2Form2_2336@@YAHQAEH@Z
?Convert2kToMode2Form1@@YAHQBEQAEIPBE@Z
?Convert2kToMode2Form1With2332@@YAHQBEQAEPBE@Z
?Convert2kToMode2Form1With2336@@YAHQBEQAEPBE@Z
?ConvertMode2_2336_to_2352@@YAHQAEPBUSectHeaderMSF@@0@Z
?ConvertPackedToRawSubChannel@@YAXPAE00H@Z
?ExecuteActions@@YAXAAVCTaskActionArray@@@Z
?ExtractPQDataFromRaw@@YAHPAUQDATAtag@@PAE@Z
?GenECCAndEDC_Mode1@@YAHQBEPBUSectHeaderMSF@@QAE@Z
?GenECCAndEDC_Mode2Form1@@YAHQBEPBUSectHeaderMSF@@0QAE@Z
?GenECCAndEDC_Mode2Form2@@YAHQBEPBUSectHeaderMSF@@0QAE@Z
?GenEDC@@YAHPAEKPAV?$LittleEndian@K@@@Z
?GenEmptyAudio96Sector@@YAXPAEHEKH@Z
?GenRawEmptySector@@YAHQAEW4TRACKMODE@@KH@Z
?GetCD_CRCTable@@YAPBKXZ
?GetOrdinalNumber@CNeroError@@UBE?AVCOrdinalNumber@@XZ
?IdentifyTrack@@YA?AW4TrackModeType@@QBE@Z
?IdentifyTrackFor2336@@YA?AW4TrackModeType@@QBE@Z
?MergePQ16WithRWRaw@@YAXPAE0PBE@Z
?NormalizeRawSector@@YAHPAEK@Z
?OpenTransfer@@YAPAVCAbstractTransfer@@AAVCTransferSettings@@K@Z
?ScrambleSector@@YAXQAE@Z
?WordSwap2352@@YAXPAE@Z
Sections
.text Size: 120KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ