d:\cm\build\public\ee_m14r2_25092006\csi\projects\ee\dist_staging\Release\Cod\hostmanager\AOLHostMgr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c8fed3ef3cd515ea1e6d660e65a0f6c1_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c8fed3ef3cd515ea1e6d660e65a0f6c1_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c8fed3ef3cd515ea1e6d660e65a0f6c1_JaffaCakes118
-
Size
320KB
-
MD5
c8fed3ef3cd515ea1e6d660e65a0f6c1
-
SHA1
562d304c7a27160025a187fb82a19d213f5dddab
-
SHA256
88f15619d35156601a6d41189b8b8200f3fa032c73c4ea8ed6368ebcf48ab626
-
SHA512
6623dfd44784105368af7b61e748e48869d195532ae1fd18b9e7ca81d6f942ee69479e4e67d75498f30d28fb863085af1b8dcd99f35e8139c2de96fc2e4db9e4
-
SSDEEP
6144:7yaEb4eNcmvMNrtCP5zwbD4fJOM8YTCnAHLIHLZhu4njki2XM:nq4eNcRteqYfLonAH89nj9b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8fed3ef3cd515ea1e6d660e65a0f6c1_JaffaCakes118
Files
-
c8fed3ef3cd515ea1e6d660e65a0f6c1_JaffaCakes118.dll windows:4 windows x86 arch:x86
1cb10e06ca2dbca681e331402117653a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FreeLibrary
CompareStringA
InterlockedExchange
GetModuleHandleA
GetModuleFileNameA
CloseHandle
GetSystemDirectoryA
LoadLibraryA
GetLastError
SetLastError
GetWindowsDirectoryA
ExitProcess
VirtualQuery
GetCurrentProcess
GetProcessWorkingSetSize
SetProcessWorkingSetSize
UnmapViewOfFile
MapViewOfFile
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
user32
SetTimer
KillTimer
WaitForInputIdle
MsgWaitForMultipleObjects
TranslateMessage
DestroyWindow
OpenDesktopW
EnumDesktopWindows
ole32
CoInitialize
CoCreateInstance
CreateBindCtx
CoTaskMemFree
StringFromCLSID
CoRegisterMessageFilter
CoInitializeEx
CoUnmarshalInterface
CreateStreamOnHGlobal
CoMarshalInterface
CoUninitialize
oleaut32
VariantChangeTypeEx
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayCopy
SafeArrayDestroy
VariantClear
VariantCopy
SysAllocString
VariantInit
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
xprt5
xprt_strlcpy
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
xprt_strcmp
xprt_memmove
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?GetLength@TBstr@XPRT@@QBEHXZ
??1TBstr@XPRT@@QAE@XZ
?GetAt@TBstr@XPRT@@QBEGH@Z
?Add@TPtrArray@XPRT@@QAEHPAX@Z
xprt_ucslcpy
_XprtStringLen@4
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
?Unlock@TSpinLock@XPRT@@QAEXXZ
XprtTrace
?Lock@TSpinLock@XPRT@@QAEXXZ
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?Empty@TBstr@XPRT@@QAEXXZ
??0TBstr@XPRT@@QAE@GH@Z
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?Lock@TCritSec@XPRT@@QAEXXZ
?Unlock@TCritSec@XPRT@@QAEXXZ
?Init@TCritSec@XPRT@@QAEXXZ
_XprtMemAlloc@4
_XprtGetSystemInfo@0
XprtTrace2
_XprtBinToBase64@16
kSystemEncoding
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??0TBstr@XPRT@@QAE@PBDPBG@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
_XprtPostQuitMessage@8
??0TBstr@XPRT@@QAE@PBG@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
_XprtMemFree@4
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
_XprtHashString@4
_XprtCompareString@8
_XprtFreeString@4
_XprtAllocString@4
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??0TBstr@XPRT@@QAE@ABV01@@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
_XprtCreateThread@8
_XprtInitialize@8
_XprtUninitialize@0
_XprtDestroyThread@8
_XprtAtomicDecrement@4
_XprtAtomicIncrement@4
?Sleep@TThread@XPRT@@SAXI@Z
?Term@TCritSec@XPRT@@QAEXXZ
xprt_memset
?Format@TBstr@XPRT@@QAAXPBGZZ
_XprtGetMilliseconds@0
?IsEmpty@TBstr@XPRT@@QBE_NXZ
_XprtGetMessageQueue@0
_XprtMessageLoop@0
?Detach@TBstr@XPRT@@QAEPAGXZ
??0TBstr@XPRT@@QAE@XZ
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Attach@TBstr@XPRT@@QAEXPAG@Z
xprt_iswdigit
msvcrt
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
_vsnprintf
_getpid
memset
_except_handler3
_purecall
qsort
strcmp
setlocale
_snwprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
_wcslwr
advapi32
RegCloseKey
Exports
Exports
Shutdown
StartHostManagerThread
StopHostManagerThread
gSMEnableTracingPtr
Sections
.text Size: 68KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.eeSMCac Size: 4KB - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE