e:\work\HEAD_Desktop10\bin\win32\Release\bdutils.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b0745b941513f97e843fa15a205a9094_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b0745b941513f97e843fa15a205a9094_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b0745b941513f97e843fa15a205a9094_JaffaCakes118
-
Size
228KB
-
MD5
b0745b941513f97e843fa15a205a9094
-
SHA1
a3e5fca94ceaf23c43876648f6bd05bb8c30ec2a
-
SHA256
df22ffeac322548ee2364a0a855dea9b229c15692a8b93157a08a57ea78fdebd
-
SHA512
7685aeae0a2c8019b93cbbc0b533342d060a49df211871fef8e87cd41d17eeaa04a25bfae4902bfde20690c1f809afcecdf4682b8176d6d7a865925852c7f167
-
SSDEEP
3072:lAoAWJEgMS4KuA4yt15Y1xDDHbS7/aSzZJ5h7x4yZIpV/vUgsmfRpbYewOvo8p:zAnexTmxTW/PdJ5bbIpKomNO3p
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b0745b941513f97e843fa15a205a9094_JaffaCakes118
Files
-
b0745b941513f97e843fa15a205a9094_JaffaCakes118.dll windows:4 windows x86 arch:x86
653bd9157fb85bbb91250fe8b63129fd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
shfolder
SHGetFolderPathA
mfc71
ord1092
ord1167
ord581
ord1084
ord1209
ord1177
ord1175
ord1201
ord1120
ord371
ord1098
ord1208
ord1206
ord765
ord315
ord1037
ord1191
ord1187
ord764
ord762
ord266
ord578
ord876
ord5403
ord2468
ord310
ord2322
ord265
ord297
ord1489
ord2902
ord6118
ord299
ord2933
ord314
msvcr71
_stricmp
_purecall
__CxxFrameHandler
_beginthreadex
_endthreadex
_CxxThrowException
free
_except_handler3
malloc
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
strncat
strlen
strncpy
strchr
fflush
fputs
fprintf
_localtime64
memset
_ctime64
_ftime64
_snprintf
fclose
ftell
__CppXcptFilter
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__security_error_handler
sprintf
strcpy
sscanf
fwrite
fgets
memcmp
_mktime64
strrchr
memcpy
_vsnwprintf
wcslen
wcscat
_wctime64
fwprintf
fputws
_vsnprintf
strcat
fopen
fseek
kernel32
GetTempPathA
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
ExitProcess
LocalAlloc
GetTempFileNameA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetUserDefaultLangID
GetModuleFileNameA
CreateDirectoryA
LoadLibraryA
GetProcAddress
LocalFree
FreeLibrary
OutputDebugStringW
MoveFileExA
CopyFileA
DeleteFileA
GetCurrentProcessId
GetCurrentThreadId
OutputDebugStringA
SetEvent
WaitForSingleObject
EnterCriticalSection
CreateEventA
GetLastError
LeaveCriticalSection
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
GetVersionExA
user32
DestroyIcon
shell32
SHGetFileInfoA
msvcp71
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIID@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
Exports
Exports
??0CAsyncProvider@@QAE@ABV0@@Z
??0CAsyncProvider@@QAE@XZ
??0CBDDebug@@QAE@H@Z
??0CFileVersionInfo@@QAE@ABV0@@Z
??0CFileVersionInfo@@QAE@XZ
??1CAsyncProvider@@QAE@XZ
??1CBDDebug@@QAE@XZ
??1CFileVersionInfo@@UAE@XZ
??4CAsyncProvider@@QAEAAV0@ABV0@@Z
??4CBDDebug@@QAEAAV0@ABV0@@Z
??4CFileVersionInfo@@QAEAAV0@ABV0@@Z
??_7CAsyncProvider@@6B@
??_7CFileVersionInfo@@6B@
??_FCBDDebug@@QAEXXZ
?AddCallbackToWaitingList@CAsyncProvider@@IAEHPAUstAsyncProviderCBData@@@Z
?BGThreadProc@CAsyncProvider@@KGIPAX@Z
?Create@CFileVersionInfo@@QAEHPAUHINSTANCE__@@@Z
?Create@CFileVersionInfo@@QAEHPBD@Z
?GetComments@CFileVersionInfo@@QBEPBDXZ
?GetCompanyName@CFileVersionInfo@@QBEPBDXZ
?GetFileDate@CFileVersionInfo@@QBE?AVCTime@ATL@@XZ
?GetFileDescription@CFileVersionInfo@@QBEPBDXZ
?GetFileFlags@CFileVersionInfo@@QBEKXZ
?GetFileFlagsMask@CFileVersionInfo@@QBEKXZ
?GetFileIcon@CFileVersionInfo@@QAEPAUHICON__@@XZ
?GetFileOs@CFileVersionInfo@@QBEKXZ
?GetFileSubtype@CFileVersionInfo@@QBEKXZ
?GetFileType@CFileVersionInfo@@QBEKXZ
?GetFileVersion@CFileVersionInfo@@QBEGH@Z
?GetFileVersion@CFileVersionInfo@@QBEPBDXZ
?GetInternalName@CFileVersionInfo@@QBEPBDXZ
?GetLegalCopyright@CFileVersionInfo@@QBEPBDXZ
?GetLegalTrademarks@CFileVersionInfo@@QBEPBDXZ
?GetMode@CBDDebug@@QAEHXZ
?GetOriginalFileName@CFileVersionInfo@@QBEPBDXZ
?GetPrivateBuild@CFileVersionInfo@@QBEPBDXZ
?GetProductName@CFileVersionInfo@@QBEPBDXZ
?GetProductVersion@CFileVersionInfo@@QBEGH@Z
?GetProductVersion@CFileVersionInfo@@QBEPBDXZ
?GetSpecialBuild@CFileVersionInfo@@QBEPBDXZ
?GetTranslationId@CFileVersionInfo@@IAEHPAXIGAAKH@Z
?InitDefaultLogPath@CBDDebug@@SA_NXZ
?NextCBID@CAsyncProvider@@IAEHXZ
?RemoveCallbackFromWaitingList@CAsyncProvider@@IAE_NH@Z
?Reset@CAsyncProvider@@UAEX_N@Z
?Reset@CFileVersionInfo@@MAEXXZ
?SetFileMode@CBDDebug@@QAEXH@Z
?SetMaxFileSize@CBDDebug@@QAEXH@Z
?SetMode@CBDDebug@@QAEXH@Z
?SetOutputFile@CBDDebug@@QAEXPBD@Z
?StartImpl@CAsyncProvider@@IAEHPAX0@Z
?Stop@CAsyncProvider@@QAE_NH@Z
?Trace@CBDDebug@@QAAXPBDZZ
?Trace@CBDDebug@@QAAXPBGZZ
?TraceImpl@CBDDebug@@IAEXPBDPAD@Z
?TraceImplW@CBDDebug@@IAEXPBGPAD@Z
?add_tdmember@@YAPAU_TDLIST@@PAU1@PAXH@Z
?change_tdmember_data@@YAHPAU_TDLIST@@PAXH@Z
?close_tdfile@@YAXPAU_TDFILE@@@Z
?compare_sections@@YAHPAU_TDFILE@@PAD1@Z
?create_tdfile@@YAPAU_TDFILE@@PBD@Z
?create_tdlist@@YAPAU_TDLIST@@PAD@Z
?debug_getmode@@YAHXZ
?debug_setfilemode@@YAXH@Z
?debug_setmode@@YAXH@Z
?debug_setof@@YAXPBD@Z
?debug_trace@@YAXPBDZZ
?debug_trace@@YAXPBGZZ
?del_tdmember@@YAXPAU_TDLIST@@@Z
?delete_section@@YAHPAU_TDFILE@@PAD@Z
?delete_value@@YAHPAU_TDFILE@@PAD1@Z
?destroy_tdlist@@YAXPAU_TDLIST@@@Z
?dup_section@@YAHPAU_TDFILE@@PAD1@Z
?get_link_section@@YAHPAD0@Z
?get_link_value@@YAHPAD0@Z
?get_section_name@@YAHPAD0@Z
?get_tdhead@@YAPAU_TDLIST@@PAU1@@Z
?get_tdsections@@YAPAU_TDLIST@@PAU1@@Z
?get_tdtail@@YAPAU_TDLIST@@PAU1@@Z
?get_value@@YAHPAU_TDFILE@@PAD1PAX1H@Z
?get_value_data@@YAHPAD0@Z
?get_value_name@@YAHPAD0@Z
?is_link@@YAHPAD@Z
?is_section@@YAHPAD@Z
?is_value@@YAHPAD@Z
?load_tdfile@@YAPAU_TDFILE@@PBD@Z
?process_record_data@@YAXPAX0@Z
?save_tdfile@@YAHPAU_TDFILE@@@Z
?save_tdfile_as@@YAHPAU_TDFILE@@PAD@Z
?search_data@@YAPAU_TDLIST@@PAU1@PAXH@Z
?section_exists@@YAHPAU_TDFILE@@PAD@Z
?set_value@@YAHPAU_TDFILE@@PAD1PAX1H@Z
?sm_bDefaultDirectoryInitialized@CBDDebug@@2_NA
?sm_szDefaultOutputPath@CBDDebug@@2PADA
?strip_spaces@@YAXPAD0@Z
?unprocess_record_data@@YAXPAX0@Z
?vdebug_trace@@YAXPBDPAD@Z
?vdebug_trace@@YAXPBGPAD@Z
Sections
.text Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE