msvcrt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b0a28eefd564e7c84cb1a1c7f90c336a_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b0a28eefd564e7c84cb1a1c7f90c336a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b0a28eefd564e7c84cb1a1c7f90c336a_JaffaCakes118
-
Size
674KB
-
MD5
b0a28eefd564e7c84cb1a1c7f90c336a
-
SHA1
17ce87eae37af3e6b2dd0ccd57ee36164961e5bc
-
SHA256
5983d975cd730ae78f9ed8ab7fd7c692863bca32148ebaef273c55bbe43938bf
-
SHA512
20dc235d19efab5dfdd951c36dcbf7bdbd9607bc289371c8a20c161b46b87ba2a63fe7c91e897603e6da495f4d221f9aa2420fb727491ea33e773d16fe593089
-
SSDEEP
12288:Zmk8mDyLRPH9Dsm3QmRm/Fj8xcGOYXHjDzj60zY1sIjsWVgm7DzVzIwC:Mk8mDyLpdDsm3QJ/FYxcoXH/6kY1HjnW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b0a28eefd564e7c84cb1a1c7f90c336a_JaffaCakes118
Files
-
b0a28eefd564e7c84cb1a1c7f90c336a_JaffaCakes118.dll windows:6 windows x86 arch:x86
3215af17ef09211d40d007cc900160f9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernelbase
GetLocaleInfoA
ntdll
RtlGetNtVersionNumbers
RtlUnwind
api-ms-win-core-console-l1-1-0
GetConsoleCP
ReadConsoleInputW
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleW
SetConsoleMode
GetConsoleMode
WriteConsoleW
ReadConsoleInputA
SetConsoleCtrlHandler
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
GetTimeFormatW
GetTimeFormatA
GetDateFormatA
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
SetLastError
GetLastError
SetErrorMode
api-ms-win-core-fibers-l1-1-0
FlsFree
FlsGetValue
FlsSetValue
FlsAlloc
api-ms-win-core-file-l1-1-0
SetFileTime
LocalFileTimeToFileTime
FindFirstFileW
WriteFile
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
FindNextFileA
GetDiskFreeSpaceA
GetLogicalDrives
ReadFile
FindNextFileW
GetFileAttributesA
SetFileAttributesA
GetFullPathNameA
GetDriveTypeA
CreateDirectoryA
RemoveDirectoryA
DeleteFileA
GetFileAttributesW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
DeleteFileW
SetFileInformationByHandle
CreateFileW
RemoveDirectoryW
GetDriveTypeW
CreateFileA
GetFileType
SetEndOfFile
FlushFileBuffers
GetFileInformationByHandle
LockFile
UnlockFile
SetFilePointer
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-heap-l1-1-0
HeapWalk
HeapCompact
HeapValidate
GetProcessHeap
HeapReAlloc
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
api-ms-win-core-interlocked-l1-1-0
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
api-ms-win-core-localization-l1-1-0
LCMapStringW
GetUserDefaultLCID
IsValidLocale
IsValidCodePage
GetLocaleInfoW
GetOEMCP
GetACP
GetCPInfo
api-ms-win-core-libraryloader-l1-1-0
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExW
GetModuleFileNameW
FreeLibrary
LoadLibraryExA
GetProcAddress
GetModuleHandleW
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
VirtualAlloc
VirtualFree
api-ms-win-core-misc-l1-1-0
SetHandleCount
Sleep
EnumSystemLocalesA
api-ms-win-core-namedpipe-l1-1-0
PeekNamedPipe
CreatePipe
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentStringsW
GetCommandLineW
SetCurrentDirectoryW
FreeEnvironmentStringsW
GetCommandLineA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetEnvironmentVariableW
GetCurrentDirectoryW
SetStdHandle
GetStdHandle
api-ms-win-core-processthreads-l1-1-0
ExitThread
CreateThread
ResumeThread
GetCurrentThread
ExitProcess
GetCurrentProcessId
GetExitCodeProcess
CreateProcessA
CreateProcessW
SetThreadStackGuarantee
GetStartupInfoW
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
GetStringTypeW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
api-ms-win-core-sysinfo-l1-1-0
SystemTimeToFileTime
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetLocalTime
GetVersionExW
GetSystemInfo
GetTickCount
SetLocalTime
api-ms-win-core-util-l1-1-0
Beep
EncodePointer
DecodePointer
Exports
Exports
$I10_OUTPUT
??0__non_rtti_object@@QAE@ABV0@@Z
??0__non_rtti_object@@QAE@PBD@Z
??0bad_cast@@AAE@PBQBD@Z
??0bad_cast@@QAE@ABQBD@Z
??0bad_cast@@QAE@ABV0@@Z
??0bad_cast@@QAE@PBD@Z
??0bad_typeid@@QAE@ABV0@@Z
??0bad_typeid@@QAE@PBD@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1__non_rtti_object@@UAE@XZ
??1bad_cast@@UAE@XZ
??1bad_typeid@@UAE@XZ
??1exception@@UAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4__non_rtti_object@@QAEAAV0@ABV0@@Z
??4bad_cast@@QAEAAV0@ABV0@@Z
??4bad_typeid@@QAEAAV0@ABV0@@Z
??4exception@@QAEAAV0@ABV0@@Z
??8type_info@@QBEHABV0@@Z
??9type_info@@QBEHABV0@@Z
??_7__non_rtti_object@@6B@
??_7bad_cast@@6B@
??_7bad_typeid@@6B@
??_7exception@@6B@
??_E__non_rtti_object@@UAEPAXI@Z
??_Ebad_cast@@UAEPAXI@Z
??_Ebad_typeid@@UAEPAXI@Z
??_Eexception@@UAEPAXI@Z
??_Fbad_cast@@QAEXXZ
??_Fbad_typeid@@QAEXXZ
??_G__non_rtti_object@@UAEPAXI@Z
??_Gbad_cast@@UAEPAXI@Z
??_Gbad_typeid@@UAEPAXI@Z
??_Gexception@@UAEPAXI@Z
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?before@type_info@@QBEHABV1@@Z
?name@type_info@@QBEPBDXZ
?raw_name@type_info@@QBEPBDXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?terminate@@YAXXZ
?unexpected@@YAXXZ
?what@exception@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CrtCheckMemory
_CrtDbgBreak
_CrtDbgReport
_CrtDbgReportV
_CrtDbgReportW
_CrtDbgReportWV
_CrtDoForAllClientObjects
_CrtDumpMemoryLeaks
_CrtIsMemoryBlock
_CrtIsValidHeapPointer
_CrtIsValidPointer
_CrtMemCheckpoint
_CrtMemDifference
_CrtMemDumpAllObjectsSince
_CrtMemDumpStatistics
_CrtReportBlockType
_CrtSetAllocHook
_CrtSetBreakAlloc
_CrtSetDbgBlockType
_CrtSetDbgFlag
_CrtSetDumpClient
_CrtSetReportFile
_CrtSetReportHook
_CrtSetReportHook2
_CrtSetReportMode
_CxxThrowException
_EH_prolog
_Getdays
_Getmonths
_Gettnames
_HUGE
_Strftime
_XcptFilter
__CppXcptFilter
__CxxCallUnwindDelDtor
__CxxCallUnwindDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__crtCompareStringA
__crtCompareStringW
__crtGetLocaleInfoW
__crtGetStringTypeW
__crtLCMapStringA
__crtLCMapStringW
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__lc_codepage
__lc_collate_cp
__lc_handle
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__amblksiz
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fileinfo
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__osver
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__winmajor
__p__winminor
__p__winver
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__set_app_type
__setlc_active
__setusermatherr
__strncnt
__threadhandle
__threadid
__toascii
__unDName
__unDNameEx
__uncaught_exception
__unguarded_readlc_active
__wargv
__wcserror
__wcserror_s
__wcsncnt
__wgetmainargs
__winitenv
_abnormal_termination
_abs64
_access
_access_s
_acmdln
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_adjust_fdiv
_aexit_rtn
_aligned_free
_aligned_free_dbg
_aligned_malloc
_aligned_malloc_dbg
_aligned_offset_malloc
_aligned_offset_malloc_dbg
_aligned_offset_realloc
_aligned_offset_realloc_dbg
_aligned_realloc
_aligned_realloc_dbg
_amsg_exit
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_beep
_beginthread
_beginthreadex
_c_exit
_cabs
_callnewh
_calloc_dbg
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_chsize_s
_chvalidator
_chvalidator_l
_clearfp
_close
_commit
_commode
_control87
_controlfp
_controlfp_s
_copysign
_cprintf
_cprintf_l
_cprintf_p
_cprintf_p_l
_cprintf_s
_cprintf_s_l
_cputs
_cputws
_creat
_crtAssertBusy
_crtBreakAlloc
_crtDbgFlag
_cscanf
_cscanf_l
_cscanf_s
_cscanf_s_l
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_ctype
_cwait
_cwprintf
_cwprintf_l
_cwprintf_p
_cwprintf_p_l
_cwprintf_s
_cwprintf_s_l
_cwscanf
_cwscanf_l
_cwscanf_s
_cwscanf_s_l
_daylight
_difftime32
_difftime64
_dstbias
_dup
_dup2
_ecvt
_ecvt_s
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_except_handler4_common
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_expand_dbg
_fcloseall
_fcvt
_fcvt_s
_fdopen
_fgetchar
_fgetwchar
_filbuf
_fileinfo
_filelength
_filelengthi64
_fileno
_findclose
_findfirst
_findfirst64
_findfirsti64
_findnext
_findnext64
_findnexti64
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fputchar
_fputwchar
_free_dbg
_freea
_freea_s
_fscanf_l
_fscanf_s_l
_fseeki64
_fsopen
_fstat
_fstat64
_fstati64
_ftime
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_ftol
_ftol2
_ftol2_sse
_ftol2_sse_excpt
_fullpath
_fullpath_dbg
_futime
_futime32
_futime64
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwscanf_l
_fwscanf_s_l
_gcvt
_gcvt_s
_get_doserrno
_get_environ
_get_errno
_get_fileinfo
_get_fmode
_get_heap_handle
_get_osfhandle
_get_osplatform
_get_osver
_get_output_format
_get_pgmptr
_get_sbh_threshold
_get_wenviron
_get_winmajor
_get_winminor
_get_winver
_get_wpgmptr
_getch
_getche
_getcwd
_getdcwd
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getsystime
_getw
_getwch
_getwche
_getws
_global_unwind2
_gmtime32
_gmtime32_s
_gmtime64
_gmtime64_s
_heapadd
_heapchk
_heapmin
_heapset
_heapused
_heapwalk
_hypot
_i64toa
_i64toa_s
_i64tow
_i64tow_s
_initterm
_initterm_e
_inp
_inpd
_inpw
_invalid_parameter
_iob
_isalnum_l
_isalpha_l
_isatty
_iscntrl_l
_isctype
_isctype_l
_isdigit_l
_isgraph_l
_isleadbyte_l
_islower_l
_ismbbalnum
_ismbbalnum_l
_ismbbalpha
_ismbbalpha_l
_ismbbgraph
_ismbbgraph_l
_ismbbkalnum
_ismbbkalnum_l
_ismbbkana
_ismbbkana_l
_ismbbkprint
_ismbbkprint_l
_ismbbkpunct
_ismbbkpunct_l
Sections
.text Size: 633KB - Virtual size: 633KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ