p:\Project Files\PEnMM\bin\util\AT.BASE.pdb
Static task
static1
Behavioral task
behavioral1
Sample
aaebadadec9b7ec624d47727aa981584_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
aaebadadec9b7ec624d47727aa981584_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
aaebadadec9b7ec624d47727aa981584_JaffaCakes118
-
Size
184KB
-
MD5
aaebadadec9b7ec624d47727aa981584
-
SHA1
15c397f809990a91ece30303e8338683e82adef7
-
SHA256
3451d64c8596d21e8d4fa5a6c88c61c8b54f02589d53faf4a4802a5ff5bdee53
-
SHA512
7ba42acd12649c236d40a8168a198f548ec12dca552ac6e325692fe208ac39730bb33df435babda22aefe50a2a8d1468db9a96171f79567c6d3432704ebdb96d
-
SSDEEP
3072:je1bwvduP+wMfpIShDarXrhuSjMPDzSwvMCBPNeM5V/iM4VU18coIFrAm2GStm:jcwvduWwITIhlwug39NeeQf218co6r44
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aaebadadec9b7ec624d47727aa981584_JaffaCakes118
Files
-
aaebadadec9b7ec624d47727aa981584_JaffaCakes118.dll windows:4 windows x86 arch:x86
0794b1074263852725bbe799d38ffa2f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FreeLibrary
CompareStringA
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryA
LoadLibraryA
GetLastError
SetLastError
InterlockedExchange
GetWindowsDirectoryA
InitializeCriticalSection
DeleteCriticalSection
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetVersionExA
SetEvent
mfc71lu
ord4100
ord2260
ord5398
ord2460
ord2261
ord4101
ord860
ord2895
ord774
ord280
ord776
ord764
ord762
ord1168
ord371
ord1093
ord1079
ord266
ord265
ord578
ord577
ord777
ord293
ord2121
ord5399
ord2462
ord310
ord6161
mslur71
_onexit
__dllonexit
__CppXcptFilter
_adjust_fdiv
_initterm
?terminate@@YAXXZ
__security_error_handler
??1type_info@@UAE@XZ
free
_except_handler3
memset
_purecall
__CxxFrameHandler
strncpy
strstr
atoi
malloc
ole32
CoInitialize
CoUninitialize
type
?GetAt@CMessages@@QAEPAVCMessage@@H@Z
?GetAt@CMessages@@QBEPBVCMessage@@H@Z
?Delete@CMessages@@QAEXH@Z
?Find@CMessages@@QBEHPBVCMessage@@@Z
?SetOperation@CContainerBase@@QAEXHHH@Z
??0CMessages@@QAE@H@Z
?GetAt@CConSettings@@QAEPAVCConSetting@@H@Z
?GetAt@CConSettings@@QBEPBVCConSetting@@H@Z
?Delete@CConSettings@@QAEXH@Z
?Find@CConSettings@@QBEHPBVCConSetting@@@Z
??0CConSettings@@QAE@H@Z
??0CCalendars@@QAE@H@Z
?GetAt@CCalendars@@QAEPAVCCalendar@@H@Z
??0CContacts@@QAE@H@Z
?Find@CContacts@@QBEHPBVCContact@@@Z
?Delete@CContacts@@QAEXH@Z
?GetAt@CContacts@@QBEPBVCContact@@H@Z
?GetAt@CContacts@@QAEPAVCContact@@H@Z
??1DailyData@@EAE@XZ
?DeleteThis@DailyData@@EAEXXZ
??1RecurrenceData@@MAE@XZ
??8RecurrenceData@@UBE_NABV0@@Z
??9RecurrenceData@@UBE_NABV0@@Z
?Serialize@RecurrenceData@@MAEXAAVCArchive@@@Z
?Find@CCalendars@@QBEHPBVCCalendar@@@Z
?GetAt@CCalendars@@QBEPBVCCalendar@@H@Z
?Delete@CCalendars@@QAEXH@Z
conmgrc
CM_InitConMgr
CM_Send
CM_Unlock
CM_DeInitConMgr
Exports
Exports
??0CAtBase@@QAE@XZ
??0DailyData@@QAE@ABV0@@Z
??0RecurrenceData@@QAE@ABV0@@Z
??1CAtBase@@QAE@XZ
??4CAtBase@@QAEAAV0@ABV0@@Z
??4DailyData@@QAEAAV0@ABV0@@Z
??4RecurrenceData@@QAEAAV0@ABV0@@Z
??4vCalendar@@QAEAAV0@ABV0@@Z
??4vCard@@QAEAAV0@ABV0@@Z
??ACCalendars@@QAEPAVCCalendar@@H@Z
??ACCalendars@@QBEPBVCCalendar@@H@Z
??ACConSettings@@QAEPAVCConSetting@@H@Z
??ACConSettings@@QBEPBVCConSetting@@H@Z
??ACContacts@@QAEPAVCContact@@H@Z
??ACContacts@@QBEPBVCContact@@H@Z
??ACMessages@@QAEPAVCMessage@@H@Z
??ACMessages@@QBEPBVCMessage@@H@Z
??_7DailyData@@6B@
??_7RecurrenceData@@6B@
??_FCCalendars@@QAEXXZ
??_FCConSettings@@QAEXXZ
??_FCContacts@@QAEXXZ
??_FCMessages@@QAEXXZ
?ChangeProc@CAtBase@@SGXKKQAPAUtagDEVICEINFO@@@Z
?DeinitConMgr@@YAXXZ
?Delete@CCalendars@@QAEXPAVCCalendar@@@Z
?Delete@CConSettings@@QAEXPAVCConSetting@@@Z
?Delete@CContacts@@QAEXPAVCContact@@@Z
?Delete@CMessages@@QAEXPAVCMessage@@@Z
?EndCheckProc@CAtBase@@SGHPAEKAAH1@Z
?GetCount@CCalendars@@QBEHXZ
?GetCount@CConSettings@@QBEHXZ
?GetCount@CContacts@@QBEHXZ
?GetCount@CMessages@@QBEHXZ
?GetEmail@CEmail@@QBE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetName@CXItem@@QBE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetNextToken@@YAHABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAHAAV12@@Z
?GetNote@CNote@@QBE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetNumber@CTelephoneNumber@@QBE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetParams@CXItem@@QBEKXZ
?GetPortNum@CAtBase@@SAHXZ
?GetRestTokens@@YAHABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAHAAV12@@Z
?GetType@CEmail@@QBEKXZ
?GetType@CPostalAddress@@QBEKXZ
?GetType@CReminder@@QBEKXZ
?GetType@CTelephoneNumber@@QBEKXZ
?GetType@CURL@@QBEKXZ
?GetURL@CURL@@QBE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetValue@CXItem@@QBE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetValueType@CReminder@@QBEKXZ
?GetXItemCount@CVObject@@QBEHXZ
?InitConMgr@@YAXXZ
?LocationDst@CMessages@@QBEKXZ
?LocationSrc@CMessages@@QBEKXZ
?Lock@CAtBase@@QAEXXZ
?Send@CAtBase@@QAEGPB_WAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetEmail@CEmail@@QAEXPB_W@Z
?SetName@CXItem@@QAEXPB_W@Z
?SetNote@CNote@@QAEXPB_W@Z
?SetNumber@CTelephoneNumber@@QAEXPB_W@Z
?SetOperation@CMessages@@QAEXH@Z
?SetParams@CXItem@@QAEXK@Z
?SetType@CEmail@@QAEXK@Z
?SetType@CPostalAddress@@QAEXK@Z
?SetType@CReminder@@QAEXK@Z
?SetType@CTelephoneNumber@@QAEXK@Z
?SetType@CURL@@QAEXK@Z
?SetURL@CURL@@QAEXPB_W@Z
?SetValue@CXItem@@QAEXPB_W@Z
?SetValueType@CReminder@@QAEXK@Z
?StatusProc@CAtBase@@SGXKKK@Z
?Unlock@CAtBase@@QAEXXZ
?sm_dwCurSize@CAtBase@@2KA
?sm_dwStatus@CAtBase@@2KA
?sm_dwTotalSize@CAtBase@@2KA
?sm_hStatusEvent@CAtBase@@2PAXA
?sm_nPort@CAtBase@@0HA
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 165KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE