d:\cm\build\public\abPrintAugust_1006\ee_services\addressBookPrint\src\win\Release\abPrintSvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
adbdd1cba4502f9da6fbfc2144f1f107_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
adbdd1cba4502f9da6fbfc2144f1f107_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
adbdd1cba4502f9da6fbfc2144f1f107_JaffaCakes118
-
Size
232KB
-
MD5
adbdd1cba4502f9da6fbfc2144f1f107
-
SHA1
5e5696438acc379bc7e6ec9b90bf97f8ad8cee78
-
SHA256
07822ed1b6be36c56ef2592af2ae3819e4fa540ea77b2d7917f8f66638bbf9d9
-
SHA512
ae385a997323e7a6ca2a11735809446efdec259e2b41bf4a142978f81f80d1f731c07e178f26ebcb50e2e90fd806fc304bc9e855842c746245bea2973baa918c
-
SSDEEP
3072:w9uEzOn/Qsgpn2DcDjHoYGq8nv7vAqHlqLtbaO4RT5YvlP+U3Hb3BDc:Pjgpn2DcDjIPvp8aTSvlP9Hhc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource adbdd1cba4502f9da6fbfc2144f1f107_JaffaCakes118
Files
-
adbdd1cba4502f9da6fbfc2144f1f107_JaffaCakes118.dll windows:4 windows x86 arch:x86
94113205e1b36dec06802af345446344
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
GetModuleHandleA
GetLastError
SetLastError
DisableThreadLibraryCalls
InterlockedExchange
CompareStringA
ExitProcess
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
CloseHandle
FreeLibrary
GlobalAlloc
GetSystemDefaultLCID
GlobalLock
GlobalUnlock
LoadLibraryA
GlobalFree
user32
SetTimer
KillTimer
TranslateMessage
MsgWaitForMultipleObjects
gdi32
SetMapMode
SelectObject
GetDeviceCaps
AbortDoc
Polyline
EndDoc
StartPage
DeleteDC
SetBkMode
EndPage
DeleteObject
GetCurrentObject
winspool.drv
ClosePrinter
comdlg32
CommDlgExtendedError
ole32
CoCreateInstance
CoUninitialize
CoRegisterMessageFilter
CoInitializeEx
CreateBindCtx
oleaut32
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayRedim
SafeArrayCopy
VariantInit
VariantChangeType
SysAllocString
VariantCopy
VariantClear
SafeArrayDestroy
xprt5
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?CompareNormal@TBstr@XPRT@@QBEHPBG@Z
?AddTail@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
?RemoveHead@TPtrList@XPRT@@QAEPAXXZ
??0TPtrList@XPRT@@QAE@H@Z
??1TPtrList@XPRT@@QAE@XZ
_XprtAtomicIncrement@4
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
xprt_strcmp
xprt_memmove
_XprtMemAlloc@4
_XprtAtomicDecrement@4
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?Lock@TSpinLock@XPRT@@QAEXXZ
?Unlock@TSpinLock@XPRT@@QAEXXZ
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
xprt_iswdigit
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?GetAt@TBstr@XPRT@@QBEGH@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
_XprtInitialize@8
_XprtUninitialize@0
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?Copy@TBstr@XPRT@@QBEPAGXZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
_XprtCreateThread@8
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??0TBstr@XPRT@@QAE@XZ
kSystemEncoding
??0TBstr@XPRT@@QAE@PBDPBG@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
??1TBstr@XPRT@@QAE@XZ
?Compare@TBstr@XPRT@@QBEHPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
?Normalize@TBstr@XPRT@@QAEAAV12@XZ
_XprtGenerateRandom@8
_XprtMemFree@4
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
??0TBstr@XPRT@@QAE@PBG@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
xprt_memset
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
msvcrt
??2@YAPAXI@Z
_adjust_fdiv
_initterm
_onexit
__dllonexit
??3@YAXPAX@Z
malloc
_except_handler3
_purecall
qsort
strcmp
_snwprintf
wcstok
free
memcpy
towupper
isspace
wcslen
swprintf
wcscmp
swscanf
memset
tolower
isupper
Exports
Exports
EEGetModuleInterop
Sections
.text Size: 80KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE