hhsetup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b3a9183bc66b564762331a7161635241_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b3a9183bc66b564762331a7161635241_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b3a9183bc66b564762331a7161635241_JaffaCakes118
-
Size
162KB
-
MD5
b3a9183bc66b564762331a7161635241
-
SHA1
8451bf191f1f14759580d3d00e343005e9c3e525
-
SHA256
50f198226f530f8d47673652aa47c6f89a42b3969d085e5d1f672d7dbdd94533
-
SHA512
1555f3468793f559013c3bebf655994e01dcf1acb899e9979835443d4b16e0cf63ce0b8fe55c1d90a12064302d9f6bcc87e94d12b6fa0e4eccd797c4059c9af0
-
SSDEEP
3072:JxSnl1eGo/04h1AV2fbniRmPmgwumSQBpTFIHcaGGqTiNfjGfJDnKM/D5yzJ:ceGShAybiMPmgwumDBpTH3WNCflnJcz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b3a9183bc66b564762331a7161635241_JaffaCakes118
Files
-
b3a9183bc66b564762331a7161635241_JaffaCakes118.dll windows:5 windows x86 arch:x86
8dd47d85b6e32029835b4b7367db5698
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_splitpath
??2@YAPAXI@Z
_vsnprintf
malloc
??3@YAXPAX@Z
_adjust_fdiv
_initterm
free
fopen
fgets
fclose
atoi
kernel32
ReadFile
MultiByteToWideChar
WideCharToMultiByte
SetLastError
lstrcmpiA
DeleteFileA
GetDriveTypeA
WriteFile
CloseHandle
CreateFileA
IsDBCSLeadByte
GetVersionExA
GetFileAttributesA
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
GetShortPathNameW
LoadLibraryW
LocalFree
GetCurrentProcess
GetCurrentThread
CreateDirectoryA
GetFileTime
VirtualProtect
GetFullPathNameA
QueryPerformanceCounter
VirtualAlloc
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
user32
CharPrevA
CharNextA
ole32
CoUninitialize
CoGetClassObject
CoInitialize
advapi32
OpenThreadToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
InitializeAcl
GetNamedSecurityInfoA
ImpersonateSelf
FreeSid
OpenProcessToken
MapGenericMask
AccessCheck
RevertToSelf
AllocateAndInitializeSid
SetEntriesInAclA
SetNamedSecurityInfoA
shlwapi
StrChrA
Exports
Exports
ServiceMain
??0CFIFOString@@QAE@XZ
??0CFolder@@QAE@XZ
??0CLocation@@QAE@XZ
??0CPointerList@@QAE@XZ
??0CTitle@@QAE@XZ
??1CCollection@@QAE@XZ
??1CFIFOString@@QAE@XZ
??1CFolder@@QAE@XZ
??1CLocation@@QAE@XZ
??1CPointerList@@QAE@XZ
??1CTitle@@QAE@XZ
??4CCollection@@QAEAAV0@ABV0@@Z
??4CFIFOString@@QAEAAV0@ABV0@@Z
??4CFolder@@QAEAAV0@ABV0@@Z
??4CLocation@@QAEAAV0@ABV0@@Z
??4CPointerList@@QAEAAV0@ABV0@@Z
??4CTitle@@QAEAAV0@ABV0@@Z
?Add@CPointerList@@QAEPAUListItem@@PAX@Z
?AddChildFolder@CFolder@@QAEKPAV1@@Z
?AddChildFolder@CFolder@@QAEPAV1@PBDKPAKG@Z
?AddChildFolder@CFolder@@QAEPAV1@PBGKPAKG@Z
?AddCollection@CCollection@@QAEPAVCColList@@XZ
?AddFolder@CCollection@@QAEPAVCFolder@@PBDKPAKG@Z
?AddFolder@CCollection@@QAEPAVCFolder@@PBGKPAKG@Z
?AddLocation@CCollection@@QAEPAVCLocation@@PBD000PAK@Z
?AddLocation@CCollection@@QAEPAVCLocation@@PBG000PAK@Z
?AddLocationHistory@CTitle@@QAEKKPBD00PBVCLocation@@00H@Z
?AddLocationHistory@CTitle@@QAEKKPBG00PBVCLocation@@00H@Z
?AddRef@CCollection@@QAEXXZ
?AddRefedTitle@CCollection@@AAEKPAVCFolder@@@Z
?AddTail@CFIFOString@@QAEKPAD@Z
?AddTitle@CCollection@@QAEPAVCTitle@@PBD0000GIPAVCLocation@@PAKH0@Z
?AddTitle@CCollection@@QAEPAVCTitle@@PBG0000GIPAVCLocation@@PAKH0@Z
?AllocCopyValue@CCollection@@AAEKPAVCParseXML@@PADPAPAD@Z
?AllocSetValue@@YGKPBDPAPAD@Z
?CheckTitleRef@CCollection@@AAEKPBDG@Z
?CheckTitleRef@CCollection@@AAEKPBGG@Z
?Close@CCollection@@QAEKXZ
?ConfirmTitles@CCollection@@QAEXXZ
?DecrementRefTitleCount@CCollection@@QAEXXZ
?DeleteChildren@CCollection@@AAEXPAPAVCFolder@@@Z
?DeleteFolder@CCollection@@QAEKPAVCFolder@@@Z
?DeleteFolders@CCollection@@AAEXPAPAVCFolder@@@Z
?DeleteLocalFiles@CCollection@@AAEXPAULocationHistory@@PAVCTitle@@@Z
?DeleteLocation@CCollection@@AAEKPAVCLocation@@@Z
?DeleteTitle@CCollection@@AAEKPAVCTitle@@@Z
?Dirty@CCollection@@QAEXXZ
?FindCollection@CCollection@@QAEPAVCColList@@PAD@Z
?FindLocation@CCollection@@QAEPAVCLocation@@PBDPAI@Z
?FindLocation@CCollection@@QAEPAVCLocation@@PBGPAI@Z
?FindTitle@CCollection@@QAEPAVCTitle@@PBDG@Z
?FindTitle@CCollection@@QAEPAVCTitle@@PBGG@Z
?First@CPointerList@@QAEPAUListItem@@XZ
?FirstLocation@CCollection@@QAEPAVCLocation@@XZ
?GetColNo@CCollection@@QAEKXZ
?GetCollectionFileName@CCollection@@QAEPBDXZ
?GetCollectionFileNameW@CCollection@@QAEPBGXZ
?GetFindMergedCHMS@CCollection@@QAEHXZ
?GetFirstChildFolder@CFolder@@QAEPAV1@XZ
?GetFirstTitle@CCollection@@QAEPAVCTitle@@XZ
?GetId@CLocation@@QBEPADXZ
?GetId@CTitle@@QAEPADXZ
?GetIdW@CLocation@@QAEPBGXZ
?GetIdW@CTitle@@QAEPBGXZ
?GetLangId@CCollection@@QAEGPBD@Z
?GetLangId@CCollection@@QAEGPBG@Z
?GetLanguage@CFolder@@QAEGXZ
?GetLanguage@CTitle@@QAEGXZ
?GetLocation@CTitle@@QAEPAULocationHistory@@K@Z
?GetMasterCHM@CCollection@@QAEHPAPADPAG@Z
?GetMasterCHM@CCollection@@QAEHPAPAGPAG@Z
?GetNextFolder@CFolder@@QAEPAV1@XZ
?GetNextLocation@CLocation@@QAEPAV1@XZ
?GetNextTitle@CTitle@@QAEPAV1@XZ
?GetOrder@CFolder@@QAEKXZ
?GetParent@CFolder@@QAEPAV1@XZ
?GetPath@CLocation@@QAEPADXZ
?GetPathW@CLocation@@QAEPBGXZ
?GetRefTitleCount@CCollection@@QAEKXZ
?GetRootFolder@CCollection@@QAEPAVCFolder@@XZ
?GetSampleLocation@CCollection@@QAEPADXZ
?GetSampleLocationW@CCollection@@QAEPBGXZ
?GetTail@CFIFOString@@QAEKPAPAD@Z
?GetTitle@CFolder@@QAEPADXZ
?GetTitle@CLocation@@QAEPADXZ
?GetTitleW@CFolder@@QAEPBGXZ
?GetTitleW@CLocation@@QAEPBGXZ
?GetVersion@CCollection@@QAEKXZ
?GetVisableRootFolder@CCollection@@QAEPAVCFolder@@XZ
?GetVolume@CLocation@@QAEPADXZ
?GetVolumeW@CLocation@@QAEPBGXZ
?HandleCollection@CCollection@@AAEKPAVCParseXML@@PAD@Z
?HandleCollectionEntry@CCollection@@AAEKPAVCParseXML@@PAD@Z
?HandleFolder@CCollection@@AAEKPAVCParseXML@@PAD@Z
?HandleLocation@CCollection@@AAEKPAVCParseXML@@PAD@Z
?HandleTitle@CCollection@@AAEKPAVCParseXML@@PAD@Z
?IncrementRefTitleCount@CCollection@@QAEXXZ
?IsDirty@CCollection@@QAEHXZ
?MergeKeywords@CCollection@@QAEHPAD@Z
?MergeKeywords@CCollection@@QAEHPAG@Z
?NewLocation@CCollection@@AAEPAVCLocation@@XZ
?NewLocationHistory@CTitle@@QAEPAULocationHistory@@XZ
?NewTitle@CCollection@@AAEPAVCTitle@@XZ
?Next@CPointerList@@QAEPAUListItem@@PAU2@@Z
?Open@CCollection@@QAEKPBD@Z
?Open@CCollection@@QAEKPBG@Z
?ParseFile@CCollection@@AAEKPBD@Z
?Release@CCollection@@AAEKXZ
?RemoveAll@CFIFOString@@QAEXXZ
?RemoveAll@CPointerList@@QAEXXZ
?RemoveCollection@CCollection@@QAEKH@Z
?RemoveCollectionEntry@CCollection@@QAEXPAD@Z
?Save@CCollection@@QAEKXZ
?SetExTitlePtr@CFolder@@QAEXPAVCExTitle@@@Z
?SetFindMergedCHMS@CCollection@@QAEXH@Z
?SetFirstChildFolder@CFolder@@QAEXPAV1@@Z
?SetId@CLocation@@QAEXPBD@Z
?SetId@CLocation@@QAEXPBG@Z
?SetId@CTitle@@QAEXPBD@Z
?SetId@CTitle@@QAEXPBG@Z
?SetLanguage@CFolder@@QAEXG@Z
?SetLanguage@CTitle@@QAEXG@Z
?SetMasterCHM@CCollection@@QAEXPBDG@Z
?SetMasterCHM@CCollection@@QAEXPBGG@Z
?SetNextFolder@CFolder@@QAEXPAV1@@Z
?SetNextLocation@CLocation@@QAEXPAV1@@Z
?SetNextTitle@CTitle@@QAEXPAV1@@Z
?SetOrder@CFolder@@QAEXK@Z
?SetParent@CFolder@@QAEXPAV1@@Z
?SetPath@CLocation@@QAEXPBD@Z
?SetPath@CLocation@@QAEXPBG@Z
?SetSampleLocation@CCollection@@QAEXPBD@Z
?SetSampleLocation@CCollection@@QAEXPBG@Z
?SetTitle@CFolder@@QAEXPBD@Z
?SetTitle@CFolder@@QAEXPBG@Z
?SetTitle@CLocation@@QAEXPBD@Z
?SetTitle@CLocation@@QAEXPBG@Z
?SetVersion@CCollection@@QAEXK@Z
?SetVolume@CLocation@@QAEXPBD@Z
?SetVolume@CLocation@@QAEXPBG@Z
?WriteFolder@CCollection@@AAEHPAPAVCFolder@@@Z
?WriteFolders@CCollection@@AAEHPAPAVCFolder@@@Z
?bIsVisable@CFolder@@QAEHXZ
?wssResetNextColNum@CCollection@@AAEXXZ
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 122KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ