d:\cm\build\public\ee_m14r2_25092006\csi\projects\ee\dist_staging\Release\Cod\hostmanager\AOLHostMgr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c162b84c9840b8b5d02684a955da48fa_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c162b84c9840b8b5d02684a955da48fa_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c162b84c9840b8b5d02684a955da48fa_JaffaCakes118
-
Size
268KB
-
MD5
c162b84c9840b8b5d02684a955da48fa
-
SHA1
61441c1532b4d383f071d1fbf7a972fe168bf80a
-
SHA256
c135f015c9094165a6d8364b2bd7a486b67b3ee133c7f807cad817ab4c716f06
-
SHA512
b454ede668b8687342c737318b4bdaacca9b799c3e3ba14434be34cec6cdd8dbd0cf800d054e18f4732735b158ea85a774e3057c93f6bfb00a0e533bb2b6fa9f
-
SSDEEP
6144:AyaEb4eNcmvMNpEcOnO2KJnqvGPqefsj+VCV:Oq4eNc0tIRqv7aEV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c162b84c9840b8b5d02684a955da48fa_JaffaCakes118
Files
-
c162b84c9840b8b5d02684a955da48fa_JaffaCakes118.dll windows:4 windows x86 arch:x86
1cb10e06ca2dbca681e331402117653a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FreeLibrary
CompareStringA
InterlockedExchange
GetModuleHandleA
GetModuleFileNameA
CloseHandle
GetSystemDirectoryA
LoadLibraryA
GetLastError
SetLastError
GetWindowsDirectoryA
ExitProcess
VirtualQuery
GetCurrentProcess
GetProcessWorkingSetSize
SetProcessWorkingSetSize
UnmapViewOfFile
MapViewOfFile
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
user32
SetTimer
KillTimer
WaitForInputIdle
MsgWaitForMultipleObjects
TranslateMessage
DestroyWindow
OpenDesktopW
EnumDesktopWindows
ole32
CoInitialize
CoCreateInstance
CreateBindCtx
CoTaskMemFree
StringFromCLSID
CoRegisterMessageFilter
CoInitializeEx
CoUnmarshalInterface
CreateStreamOnHGlobal
CoMarshalInterface
CoUninitialize
oleaut32
VariantChangeTypeEx
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayCopy
SafeArrayDestroy
VariantClear
VariantCopy
SysAllocString
VariantInit
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
xprt5
xprt_strlcpy
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
xprt_strcmp
xprt_memmove
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?GetLength@TBstr@XPRT@@QBEHXZ
??1TBstr@XPRT@@QAE@XZ
?GetAt@TBstr@XPRT@@QBEGH@Z
?Add@TPtrArray@XPRT@@QAEHPAX@Z
xprt_ucslcpy
_XprtStringLen@4
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
?Unlock@TSpinLock@XPRT@@QAEXXZ
XprtTrace
?Lock@TSpinLock@XPRT@@QAEXXZ
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?Empty@TBstr@XPRT@@QAEXXZ
??0TBstr@XPRT@@QAE@GH@Z
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?Lock@TCritSec@XPRT@@QAEXXZ
?Unlock@TCritSec@XPRT@@QAEXXZ
?Init@TCritSec@XPRT@@QAEXXZ
_XprtMemAlloc@4
_XprtGetSystemInfo@0
XprtTrace2
_XprtBinToBase64@16
kSystemEncoding
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??0TBstr@XPRT@@QAE@PBDPBG@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
_XprtPostQuitMessage@8
??0TBstr@XPRT@@QAE@PBG@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
_XprtMemFree@4
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
_XprtHashString@4
_XprtCompareString@8
_XprtFreeString@4
_XprtAllocString@4
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??0TBstr@XPRT@@QAE@ABV01@@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
_XprtCreateThread@8
_XprtInitialize@8
_XprtUninitialize@0
_XprtDestroyThread@8
_XprtAtomicDecrement@4
_XprtAtomicIncrement@4
?Sleep@TThread@XPRT@@SAXI@Z
?Term@TCritSec@XPRT@@QAEXXZ
xprt_memset
?Format@TBstr@XPRT@@QAAXPBGZZ
_XprtGetMilliseconds@0
?IsEmpty@TBstr@XPRT@@QBE_NXZ
_XprtGetMessageQueue@0
_XprtMessageLoop@0
?Detach@TBstr@XPRT@@QAEPAGXZ
??0TBstr@XPRT@@QAE@XZ
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Attach@TBstr@XPRT@@QAEXPAG@Z
xprt_iswdigit
msvcrt
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
_vsnprintf
_getpid
memset
_except_handler3
_purecall
qsort
strcmp
setlocale
_snwprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
_wcslwr
advapi32
RegCloseKey
Exports
Exports
Shutdown
StartHostManagerThread
StopHostManagerThread
gSMEnableTracingPtr
Sections
.text Size: 68KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.eeSMCac Size: 4KB - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ