C:\BUILD_~1\jdk6_11\control\build\WINDOW~1\tmp\deploy\common\bin\deploy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a956a41968ee0e5635c9600a3cd59d60_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a956a41968ee0e5635c9600a3cd59d60_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a956a41968ee0e5635c9600a3cd59d60_JaffaCakes118
-
Size
272KB
-
MD5
a956a41968ee0e5635c9600a3cd59d60
-
SHA1
c28a270255a16f4fac9e90082981ca2b3384e163
-
SHA256
a510fdfec164ec41757437ff8d676e7018f3571bfaf623ee096c9beb6715e8a3
-
SHA512
562959e689f28f4ba1bc78e29a9698e75f3692d031934baacd247c50bd62655ae32bab408918f8855cbc390320baa67e35aa2c230b1fdf22c7d0052b2fa11b7f
-
SSDEEP
3072:K7FV9d0susPjFZuoxwMVMQgRnJ5mw/G0jgVxBDCH7OgtBLfkajaAXjBjsPVHDJAa:md7PBpZgRnrmIjm347FLfPFsVHDqjmZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a956a41968ee0e5635c9600a3cd59d60_JaffaCakes118
Files
-
a956a41968ee0e5635c9600a3cd59d60_JaffaCakes118.dll windows:4 windows x86 arch:x86
20b1512a5131139328cdcaae301f8576
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
crypt32
CryptAcquireCertificatePrivateKey
CertGetPublicKeyLength
CertGetEnhancedKeyUsage
CertFreeCertificateChain
CertOpenSystemStoreA
CertEnumCertificatesInStore
CertCloseStore
CertGetCertificateChain
kernel32
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
FormatMessageA
ExpandEnvironmentStringsA
SystemTimeToFileTime
GetSystemTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FindResourceA
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
RaiseException
GetProcAddress
LoadLibraryA
GetModuleHandleA
lstrlenA
FreeLibrary
LocalFree
WideCharToMultiByte
GetModuleFileNameA
CloseHandle
GetLastError
lstrlenW
GetWindowsDirectoryA
GetSystemDirectoryA
GetCurrentProcessId
GetTempPathA
GetCurrentProcess
LoadResource
SizeofResource
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
user32
GetWindowLongA
GetWindowThreadProcessId
wsprintfA
CharNextA
MessageBoxA
wsprintfW
ExitWindowsEx
DefWindowProcA
RegisterClassA
CreateWindowExA
GetForegroundWindow
SetWindowLongA
TranslateMessage
DispatchMessageA
GetMessageA
ReleaseDC
GetDC
GetDesktopWindow
CreateIconIndirect
DestroyIcon
CreatePopupMenu
AppendMenuW
ModifyMenuW
SetMenuDefaultItem
PostMessageA
TrackPopupMenu
SetForegroundWindow
GetCursorPos
FindWindowExA
GetWindowRect
PostQuitMessage
ShowWindow
gdi32
DeleteObject
CreateDIBitmap
CreateDIBSection
CreateBitmap
GetStockObject
advapi32
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegEnumValueA
RegFlushKey
RegOpenKeyA
RegCreateKeyA
CryptCreateHash
CryptSetHashParam
CryptSignHashA
CryptDestroyHash
CryptDestroyKey
CryptGetUserKey
CryptSetKeyParam
CryptGetKeyParam
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryInfoKeyA
GetUserNameW
shell32
ShellExecuteA
Shell_NotifyIconW
ShellExecuteExA
FindExecutableA
ole32
CoInitialize
CLSIDFromProgID
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoUninitialize
oleaut32
VarUI4FromStr
SysFreeString
VariantInit
VariantClear
wininet
InternetCloseHandle
InternetSetOptionA
InternetGoOnline
InternetGetCookieA
InternetSetCookieA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetQueryOptionA
urlmon
FindMimeFromData
msvcr71
_onexit
__dllonexit
??1type_info@@UAE@XZ
wcsncpy
_local_unwind2
strstr
realloc
??_U@YAPAXI@Z
_resetstkoflw
_dup
_dup2
_lseek
_tempnam
calloc
strrchr
strtok
fopen
fputs
fclose
remove
malloc
??_V@YAXPAX@Z
free
wcscmp
wcslen
_except_handler3
strncpy
??2@YAPAXI@Z
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
_purecall
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
_strdup
_stricmp
_close
_read
__security_error_handler
memset
_open
_fstat
_initterm
Exports
Exports
??0BasicPerfHelper@@QAE@ABV0@@Z
??0BasicPerfHelper@@QAE@ABVSystemTime@@AAVNativeLock@@@Z
??0BasicPerfStore@@QAE@ABV0@@Z
??0BasicPerfStore@@QAE@ABVSystemTime@@AAVNativeLock@@@Z
??0DeployPerf@@QAE@ABV0@@Z
??0DeployPerf@@QAE@XZ
??0NativeLock@@IAE@XZ
??0NativeLocker@@QAE@PAVNativeLock@@@Z
??0PerfHelper@@QAE@ABV0@@Z
??0PerfHelper@@QAE@XZ
??0PerfLabel@@QAE@ABV0@@Z
??0PerfLabel@@QAE@XZ
??0PerfLabel@@QAE@_JPBD@Z
??0PerfStore@@QAE@ABV0@@Z
??0PerfStore@@QAE@XZ
??0SystemTime@@QAE@ABV0@@Z
??0SystemTime@@QAE@XZ
??0WinLock@@QAE@XZ
??0WinTime@@QAE@ABV0@@Z
??0WinTime@@QAE@XZ
??1BasicPerfHelper@@UAE@XZ
??1BasicPerfStore@@UAE@XZ
??1DeployPerf@@UAE@XZ
??1NativeLock@@MAE@XZ
??1NativeLocker@@QAE@XZ
??1PerfHelper@@UAE@XZ
??1PerfStore@@UAE@XZ
??1SystemTime@@UAE@XZ
??1WinLock@@UAE@XZ
??1WinTime@@UAE@XZ
??4DeployPerf@@QAEAAV0@ABV0@@Z
??4NativeLocker@@QAEAAV0@ABV0@@Z
??4PerfHelper@@QAEAAV0@ABV0@@Z
??4PerfLabel@@QAEAAV0@ABV0@@Z
??4PerfStore@@QAEAAV0@ABV0@@Z
??4SystemTime@@QAEAAV0@ABV0@@Z
??4WinTime@@QAEAAV0@ABV0@@Z
??_7BasicPerfHelper@@6B@
??_7BasicPerfStore@@6B@
??_7DeployPerf@@6B@
??_7NativeLock@@6B@
??_7PerfHelper@@6B@
??_7PerfStore@@6B@
??_7SystemTime@@6B@
??_7WinLock@@6B@
??_7WinTime@@6B@
?LABEL_BUFFER_SIZE@PerfLabel@@2IB
?MAX_LABEL_COUNT@BasicPerfStore@@0IB
?_get@BasicPerfStore@@ABE?AVPerfLabel@@I@Z
?acquire@WinLock@@UAEXXZ
?calculateJavaEpoch@WinTime@@CA_JXZ
?get@BasicPerfStore@@UBE?AVPerfLabel@@I@Z
?getCurrentTime@BasicPerfHelper@@UBE_JXZ
?getCurrentTime@WinTime@@UBE_JXZ
?getJavaObj@PerfLabel@@QBEPAV_jobject@@PAUJNIEnv_@@@Z
?initStore@BasicPerfHelper@@UAE_NXZ
?labelToString@PerfLabel@@QBEPAV_jstring@@PAUJNIEnv_@@@Z
?put@BasicPerfHelper@@UAEXPAUJNIEnv_@@PAV_jstring@@@Z
?put@BasicPerfHelper@@UAEXPBD@Z
?put@BasicPerfStore@@QAEXPAUJNIEnv_@@PAV_jstring@@@Z
?put@BasicPerfStore@@UAEXPBD@Z
?put@PerfHelper@@MAEXPAUJNIEnv_@@PAV_jstring@@@Z
?release@WinLock@@UAEXXZ
?size@BasicPerfStore@@UBEIXZ
?toArray@BasicPerfHelper@@UBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
?toArray@BasicPerfStore@@QBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
?toArray@PerfHelper@@MBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
GetDeployPerf
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_ExpandEnvironmentStrings@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_FindMimeFromData@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegCloseKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegCreateKeyEx@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegDeleteKey@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegDeleteValue@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegEnumKeyEx@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegEnumValue@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegFlushKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegOpenKey@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegQueryInfoKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegQueryValueEx@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegSetValueEx@20
_Java_com_sun_deploy_config_UnixConfig_getPlatformPID@8
_Java_com_sun_deploy_config_WinConfig_addRemoveProgramsAdd@36
_Java_com_sun_deploy_config_WinConfig_addRemoveProgramsRemove@16
_Java_com_sun_deploy_config_WinConfig_canDownloadJRE@8
_Java_com_sun_deploy_config_WinConfig_getBrowserHomePathImpl@8
_Java_com_sun_deploy_config_WinConfig_getBrowserPath@8
_Java_com_sun_deploy_config_WinConfig_getPlatformMaxCommandLineLength@8
_Java_com_sun_deploy_config_WinConfig_getPlatformSystemHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_getPlatformUserHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_getSystemExecutableHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_installShortcut@36
_Java_com_sun_deploy_config_WinConfig_isBrowserFireFox@8
_Java_com_sun_deploy_config_WinConfig_isNativeModalDialogUp@8
_Java_com_sun_deploy_config_WinConfig_isPlatformWindowsVista@8
_Java_com_sun_deploy_config_WinConfig_notifyJREInstalled@12
_Java_com_sun_deploy_config_WinConfig_showDocument@12
_Java_com_sun_deploy_net_cookie_IExplorerCookieHandler_getCookieInfo@12
_Java_com_sun_deploy_net_cookie_IExplorerCookieHandler_setCookieInfo@16
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_askUserGoOnline@12
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_isGlobalOffline@8
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_setGlobalOffline@12
_Java_com_sun_deploy_net_proxy_WIExplorerAutoProxyHandler_evalScript@12
_Java_com_sun_deploy_net_proxy_WIExplorerProxyConfig_getBrowserProxySettings@8
_Java_com_sun_deploy_net_proxy_WIExplorerProxyConfig_performAutoDetection@8
_Java_com_sun_deploy_perf_NativePerfHelper_put@12
_Java_com_sun_deploy_perf_NativePerfHelper_toArray@8
_Java_com_sun_deploy_security_MSCredentialManager_decryptMSPassword@12
_Java_com_sun_deploy_security_MSCredentialManager_encryptMSPassword@12
_Java_com_sun_deploy_security_MSCredentialManager_getLoginUID@8
_Java_com_sun_deploy_security_MSCredentialManager_isEncryptionAvailable@8
_Java_com_sun_deploy_security_MSCryptoDSASignature_nativeSignHash@24
_Java_com_sun_deploy_security_MSCryptoNONEwithRSASignature_nativeSignHash@24
_Java_com_sun_deploy_security_MSCryptoRSAKey_cleanUp@16
_Java_com_sun_deploy_security_WIExplorerBrowserAuthenticator14_getAuthentication@12
_Java_com_sun_deploy_security_WIExplorerBrowserAuthenticator_getAuthFromInet@28
_Java_com_sun_deploy_security_WIExplorerCertStore_loadCertificates@20
_Java_com_sun_deploy_security_WIExplorerMyKeyStore_loadKeysAndCertificateChains@16
_Java_com_sun_deploy_security_WSeedGenerator_generateSeed@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_appendMenu@32
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_createNativeIcon@28
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_createPopupMenu@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_createWindow@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_defWindowProc@36
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_destroyIcon@16
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_getCurrentProcessId@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_hasBalloonTooltipShown0@16
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_isBalloonClickInBounds@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_isEnabled0@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_mainLoop@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_modifyMenu@32
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_notifyShell@60
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_openControlPanel@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_postQuitMessage@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_registerClass@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_setBalloonTooltipShown0@20
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_setMenuDefaultItem@24
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_setUserData@16
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_showPopupMenu@24
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_showSysTray@16
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_showWindow@20
_Java_com_sun_deploy_util_ConsoleHelper_dumpAllStacksImpl@8
_Java_com_sun_deploy_util_ConsoleHelper_preMustangDumpAllStacksImpl@8
_Java_com_sun_deploy_util_WinRegistry_getWindowsDirectory@8
_Java_com_sun_deploy_util_WinRegistry_initIDs@8
_Java_com_sun_deploy_util_WinRegistry_sysCloseKey@12
_Java_com_sun_deploy_util_WinRegistry_sysCreateKey@20
_Java_com_sun_deploy_util_WinRegistry_sysDeleteKey@16
_Java_com_sun_deploy_util_WinRegistry_sysOpenKey@20
_Java_com_sun_deploy_util_WinRegistry_sysQueryKey@16
_Java_com_sun_deploy_util_WinRegistry_sysReboot@8
_Java_com_sun_deploy_util_WinRegistry_sysSetStringValue@20
Sections
.text Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE