d:\PCBuildArea\Blowout-Code\UCC\ReleaseRetail\UCC.pdb
Static task
static1
Behavioral task
behavioral1
Sample
be9d4a2e66c2f7a072c592fc770f54a6_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
be9d4a2e66c2f7a072c592fc770f54a6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
be9d4a2e66c2f7a072c592fc770f54a6_JaffaCakes118
-
Size
88KB
-
MD5
be9d4a2e66c2f7a072c592fc770f54a6
-
SHA1
90ef2aa6126f7bf070a6ae74cf50f0d424713587
-
SHA256
49848efced641e0dde19d31c3f3570d44123f6dd07ad431d97d248d1449d4851
-
SHA512
7a50103247266d47a5274724b3d8ab32d32dcd1680c9e3d17000be1fdf12c2134c83c1d1e6150ffcdaf767aeacc11e4acdaa4ecc2b9297e06c461cefe0e73bd2
-
SSDEEP
768:cOKrofQwefPmVavg2/YKteMqu7+3tBUXo4kqj2EXgpIqF1bMt4AbbE4:p4weXmVQg2ASeMqeqtBXnqFQp8DE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be9d4a2e66c2f7a072c592fc770f54a6_JaffaCakes118
Files
-
be9d4a2e66c2f7a072c592fc770f54a6_JaffaCakes118.exe windows:4 windows x86 arch:x86
a7310cc8fa7979ea7be63609f20cdaa0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
core
?GCRCTable@@3PAKA
?GMalloc@@3PAVFMalloc@@A
??DFString@@QBEPBGXZ
?Logf@FOutputDevice@@QAAXW4EName@@PBGZZ
?appTimestamp@@YAPBGXZ
?GLogHook@@3PAVFOutputDevice@@A
?appStrstr@@YAPAGPBG0@Z
?GIsUTracing@@3HA
?GEnableLogs@@3HA
?SafeString@FName@@SAPBGW4EName@@@Z
?GSecondsPerCycle@@3NA
?GBaseCyles@@3_KA
?GNull@@3PAVFOutputDevice@@A
?appStrcat@@YAPAGPAGPBG@Z
?appPackage@@YAPBGXZ
?GFileManager@@3PAVFFileManager@@A
?appSprintf@@YAHPAGPBGZZ
?appComputerName@@YAPBGXZ
?ParseParam@@YAHPBG0@Z
?Parse@@YAHPBG0PAGH@Z
?appCmdLine@@YAPBGXZ
?appStrlen@@YAHPBG@Z
?appStrcpy@@YAPAGPAGPBG@Z
?appBaseDir@@YAPBGXZ
?SuppressAll@FName@@2HA
?SafeSuppressed@FName@@SAHW4EName@@@Z
?GIsCriticalError@@3HA
?SetTimestampEverySerialize@FOutputDevice@@UAEXH@Z
?Flush@FOutputDevice@@UAEXXZ
?appRequestExit@@YAXH@Z
?LocalizeError@@YAPBGPBDPBG1@Z
?GIsGuarded@@3HA
?appStrncat@@YAPAGPAGPBGH@Z
?appStrncpy@@YAPAGPAGPBGH@Z
?GErrorHist@@3PAGA
?StaticShutdownAfterError@UObject@@SAXXZ
?GLog@@3PAVFOutputDevice@@A
?GIsRunning@@3HA
?MapCheck_Add@FFeedbackContext@@UAEXHPAXPBG@Z
?MapCheck_Clear@FFeedbackContext@@UAEXXZ
?MapCheck_Hide@FFeedbackContext@@UAEXXZ
?MapCheck_ShowConditionally@FFeedbackContext@@UAEXXZ
?MapCheck_Show@FFeedbackContext@@UAEXXZ
??1FString@@QAE@XZ
?appStrlwr@@YAPAGPAG@Z
??DFName@@QBEPBGXZ
?GIsEditor@@3HA
?GIsClient@@3HA
?appGetVarArgs@@YAHPAGHAAPBG@Z
?GIsSlowTask@@3HA
?appFailAssert@@YAXPBD0H@Z
?ExistsEx@FFileManager@@UAEHPBGH@Z
?ArchiveLookup@FFileManager@@UAEPAXPBG@Z
?VerifySignature@FFileManager@@UAEHPBGK@Z
?WriteSignature@FFileManager@@UAEHPBGK@Z
?Bloat@FFileManager@@UAEHPBGK@Z
?Exists@FFileManager@@UAEHPBG@Z
?Spawn@FFileManager@@UAEHABVFString@@AAHAAVFOutputDevice@@@Z
?ExpandPath@FFileManager@@UAE?AVFString@@PBG@Z
?Init@FFileManager@@UAEXH@Z
??0FString@@QAE@PBD@Z
?NumTraceBins@FMalloc@@UAEKXZ
?TotalContiguous@FMalloc@@UAEKXZ
?GetTraceBinSize@FMalloc@@UAEKH@Z
?SetTraceBinSize@FMalloc@@UAEXHK@Z
?ClearTraceBins@FMalloc@@UAEXXZ
?GetTraceBin@FMalloc@@UAEKH@Z
??0FString@@QAE@ABV0@@Z
??YFString@@QAEAAV0@PBG@Z
?appStricmp@@YAHPBG0@Z
?Logf@FOutputDevice@@QAAXPBGZZ
??1FRegistryObjectInfo@@QAE@XZ
?Add@FArray@@QAEHHHH@Z
?StaticConstructObject@UObject@@SAPAV1@PAVUClass@@PAV1@VFName@@K1PAVFOutputDevice@@H@Z
?GError@@3PAVFOutputDeviceError@@A
?GetTransientPackage@UObject@@SAPAVUPackage@@XZ
?PrivateStaticClass@UCommandlet@@0VUClass@@A
??4FString@@QAEAAV0@ABV0@@Z
?appStrchr@@YAPAGPBGH@Z
?winToANSI@@YAPADPADPBGH@Z
?winGetSizeANSI@@YAHPBG@Z
?GUnicodeOS@@3HA
?LoadWarn@FArchive@@UAEHXZ
?GetError@FArchive@@UAEHXZ
?Flush@FArchive@@UAEXXZ
?DetachLazyLoader@FArchive@@UAEXPAVFLazyLoader@@@Z
?AttachLazyLoader@FArchive@@UAEXPAVFLazyLoader@@@Z
?SetStopper@FArchive@@UAEXH@Z
?AtStopper@FArchive@@UAEHXZ
?AtEnd@FArchive@@UAEHXZ
?MapObject@FArchive@@UAEHPAVUObject@@@Z
?MapName@FArchive@@UAEHPAVFName@@@Z
??6FArchive@@UAEAAV0@AAVFName@@@Z
??6FArchive@@UAEAAV0@AAPAVUObject@@@Z
?CountBytes@FArchive@@UAEXKK@Z
?Preload@FArchive@@UAEXPAVUObject@@@Z
?SerializeInt@FArchive@@UAEXAAKK@Z
?SerializeBits@FArchive@@UAEXPAXH@Z
??1FArchive@@UAE@XZ
??4FString@@QAEAAV0@PBG@Z
??0FString@@QAE@XZ
??0FArchive@@QAE@XZ
?appGetSystemErrorMessage@@YAPBGH@Z
?Precache@FArchive@@UAEXH@Z
?TotalSize@FArchive@@UAEHXZ
GIsSSE
??0FString@@QAE@PBG@Z
?appFromAnsi@@YAPBGPBDPAG@Z
?appToAnsi@@YAPBDPBGPAD@Z
??_7FArchive@@6B@
?appStaticString1024@@YAPAGXZ
?Remove@FArray@@QAEXHHHH@Z
?GSortItems@@3KA
?GSortCalls@@3KA
?GSortCycles@@3KA
??1FArray@@QAE@XZ
??DFString@@QBE?AV0@ABV0@@Z
??DFString@@QBE?AV0@PBG@Z
?Realloc@FArray@@IAEXHH@Z
?winGetSizeUNICODE@@YAHPBD@Z
?winToUNICODE@@YAPAGPAGPBDH@Z
?appAtoi@@YAHPBG@Z
?appAtof@@YAMPBG@Z
?Log@FOutputDevice@@QAEXPBG@Z
??YFString@@QAEAAV0@ABV0@@Z
?Printf@FString@@SA?AV1@PBGZZ
??8FString@@QBEHPBG@Z
?appSaveStringToFile@@YAHABVFString@@PBGPAVFFileManager@@@Z
??8FString@@QBEHABV0@@Z
?appLoadFileToString@@YAHAAVFString@@PBGPAVFFileManager@@@Z
?appStrcmp@@YAHPBG0@Z
?appExit@@YAXXZ
?appPreExit@@YAXXZ
?GWarn@@3PAVFFeedbackContext@@A
?ParseParms@UObject@@QAEXPBG@Z
?AddToRoot@UObject@@QAEXXZ
?GetFullName@UObject@@QBEPBGPAG@Z
??9FString@@QBEHPBG@Z
?Mid@FString@@QBE?AV1@HH@Z
?InStr@FString@@QBEHPBGH@Z
?Log@FOutputDevice@@QAEXABVFString@@@Z
??HFString@@QAE?AV0@PBG@Z
??HFString@@QAE?AV0@ABV0@@Z
?GetDefaultObject@UClass@@QAEPAVUObject@@XZ
?ParseToken@@YAHAAPBGAAVFString@@H@Z
?StaticLoadClass@UObject@@SAPAVUClass@@PAV2@PAV1@PBG2KPAVUPackageMap@@@Z
?GLazyLoad@@3HA
?GIsServer@@3HA
?GIsScriptable@@3HA
?GIsUCC@@3HA
?GetRegistryObjects@UObject@@SAXAAV?$TArray@VFRegistryObjectInfo@@@@PAVUClass@@1H@Z
?PrivateStaticClass@UClass@@0V1@A
?appItoa@@YAPAGH@Z
?appInit@@YAXPBG0PAVFMalloc@@PAVFOutputDevice@@PAVFOutputDeviceError@@PAVFFeedbackContext@@PAVFFileManager@@P6APAVFConfigCache@@XZH@Z
?GIsStarted@@3HA
kernel32
OutputDebugStringW
GetFileSize
CreateFileA
CreateFileW
SetFilePointer
CloseHandle
SetFileAttributesA
SetFileAttributesW
WriteFile
GetLastError
DeleteFileA
DeleteFileW
GetFileAttributesA
GetFileAttributesW
MoveFileA
MoveFileW
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetFileTime
SetFileTime
ReadFile
CopyFileA
CopyFileW
CreateDirectoryA
CreateDirectoryW
GetExitCodeProcess
WaitForMultipleObjects
CreateProcessW
DuplicateHandle
GetCurrentProcess
CreatePipe
RemoveDirectoryA
RemoveDirectoryW
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
GetCurrentProcessId
GetCommandLineW
GetModuleHandleA
msvcr70
towupper
__CxxFrameHandler
wprintf
_CxxThrowException
fflush
_iob
fgets
malloc
free
realloc
_heapchk
towlower
_wctime64
_wstat64
_stat
_utime
_wspawnv
??1type_info@@UAE@XZ
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_cexit
exit
__p___initenv
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
_except_handler3
_purecall
Exports
Exports
GPackage
Sections
.text Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE