c:\steam3_rel_client\bin\Release\vstdlib_s.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cfc211686cc3c9c97237852aae7c3051_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cfc211686cc3c9c97237852aae7c3051_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
cfc211686cc3c9c97237852aae7c3051_JaffaCakes118
-
Size
200KB
-
MD5
cfc211686cc3c9c97237852aae7c3051
-
SHA1
2b7efed62f728562737c07727f5ad64bf134b9c7
-
SHA256
43bf6ff533dda41fcb31b1267580af0e0c852a82b60915da3027ef941e3d1f61
-
SHA512
329b97521ad4201852be4bfe06cc40d4f1ff7fb8734b99de5d5699b0bfd37d20c31828c7f15bcdc894b83a2383db6a6424361004bc041d9ea6a5f1591a708b28
-
SSDEEP
3072:H5hEf99KYgIc+0xbGZ8a5DBg6eWGMB5YPS79O+lclwS/rTH:aXKdGZ8a5DyBCaPS79O61K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cfc211686cc3c9c97237852aae7c3051_JaffaCakes118
Files
-
cfc211686cc3c9c97237852aae7c3051_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Exports
Exports
??0CCommandLineParam@@QAE@PBD0@Z
??0CGaussianRandomStream@@QAE@PAVIUniformRandomStream@@@Z
??0CMemTree@@QAE@PAVCValObject@@H@Z
??0CUniformRandomStream@@QAE@ABV0@@Z
??0CUniformRandomStream@@QAE@XZ
??1CMemTree@@QAE@XZ
??4CCommandLineParam@@QAEAAV0@ABV0@@Z
??4CGaussianRandomStream@@QAEAAV0@ABV0@@Z
??4CMemTree@@QAEAAV0@ABV0@@Z
??4CUniformRandomStream@@QAEAAV0@ABV0@@Z
??_7CUniformRandomStream@@6B@
??_FCGaussianRandomStream@@QAEXXZ
?AttachToStream@CGaussianRandomStream@@QAEXPAVIUniformRandomStream@@@Z
?GenerateRandomNumber@CUniformRandomStream@@AAEHXZ
?GetHParam@CCommandLineParam@@QAEHXZ
?Q_stristr@@YAPBDPBD0@Z
?RandomFloat@CGaussianRandomStream@@QAEMMM@Z
?RandomFloat@CUniformRandomStream@@UAEMMM@Z
?RandomInt@CUniformRandomStream@@UAEHHH@Z
?SetSeed@CUniformRandomStream@@UAEXH@Z
CommandLine
Coroutine_Cancel
Coroutine_Continue
Coroutine_Create
Coroutine_DebugBreak
Coroutine_GetCurrentlyActive
Coroutine_IsActive
Coroutine_ReleaseThreadMemory
Coroutine_Test
Coroutine_ValidateGlobals
Coroutine_YieldToMain
CreateInterface
InstallUniformRandomStream
KeyValuesSystem
Q_AppendSlash
Q_ComposeFileName
Q_DefaultExtension
Q_ExtractFileExtension
Q_ExtractFilePath
Q_FileBase
Q_FixSlashes
Q_GetFileExtension
Q_IsAbsolutePath
Q_MakeAbsolutePath
Q_RemoveDotSlashes
Q_SetExtension
Q_SplitString
Q_SplitString2
Q_StrLeft
Q_StrRight
Q_StrSlice
Q_StrSubst
Q_StripExtension
Q_StripFilename
Q_StripLastDir
Q_StripTrailingSlash
Q_UTF8ToUnicode
Q_UnicodeToUTF8
Q_UnqualifiedFileName
Q_atof
Q_atoi
Q_binarytohex
Q_hextobinary
Q_pretifymem
Q_pretifynum
Q_snprintf
Q_strcasecmp
Q_strcat
Q_stristr
Q_strncasecmp
Q_strncat
Q_strncmp
Q_strncpy
Q_strnicmp
Q_strnlwr
Q_vsnprintf
Q_wcsncpy
RandomFloat
RandomGaussianFloat
RandomInt
RandomSeed
VStdLib_GetICVarFactory
_Q_memcmp
_Q_memcpy
_Q_memmove
_Q_memset
_Q_strcmp
_Q_stricmp
_Q_strlen
_Q_strlower
_Q_strrchr
_Q_strstr
_Q_strupr
_Q_wcscmp
_Q_wcslen
Sections
.text Size: 152KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.Silvana Size: 152B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE