G:\CXR18\BSF\intel_a\code\bin\CATDynClash.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d63b079032a2cda03b64dca075440f7a_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d63b079032a2cda03b64dca075440f7a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d63b079032a2cda03b64dca075440f7a_JaffaCakes118
-
Size
191KB
-
MD5
d63b079032a2cda03b64dca075440f7a
-
SHA1
e4407ce54d9775c53bb6e1f25b0fa5fb4f3ea757
-
SHA256
b2ff7c06ccd6476a26cbe9842bd961d971138b44157113ee53d89f1766ab8dd1
-
SHA512
7f0d7badf1678b4ca9dfdfb7c34d4ee6c66373049164b119d56c52518ac7e2080bdab90924ac0b67ca05505cde2bddaf8dfdf908f56d44665578a11d521f12da
-
SSDEEP
3072:ODN0lXjn1GbKFZRy+Vbues3q9fEmX/VG17aKXonzPBOVfwfTZVism+9e:q0lrYuP7ur+V/V2Xoz5FlVd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d63b079032a2cda03b64dca075440f7a_JaffaCakes118
Files
-
d63b079032a2cda03b64dca075440f7a_JaffaCakes118.dll windows:4 windows x86 arch:x86
1a78faba6c25a6857f48a245d580bc39
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
js0group
??1CATRawCollPV@@UAE@XZ
??4CATRawCollPV@@QAEAAV0@ABV0@@Z
?RemoveDuplicates@CATRawCollPV@@QAEHPAV1@@Z
?fct_RetrieveMetaObject@@YAPAVCATMetaClass@@PBDW4ENUMTypeOfClass@@PAV1@00J@Z
?MetaObject@CATBaseUnknown@@SGPAVCATMetaClass@@XZ
??0CATMetaClass@@QAE@PBU_GUID@@PBDPAV0@2W4ENUMTypeOfClass@@@Z
??2CATMetaClass@@SAPAXI@Z
?Tie_Destruct@@YAXPAUIUnknown@@PAPAVCATBaseUnknown@@W4ENUMTypeOfClass@@J@Z
?GetTypeOfClass@CATMetaClass@@QBG?AW4ENUMTypeOfClass@@XZ
?QueryInterface@CATBaseUnknown@@UBEPAV1@PBD@Z
?IsA@CATBaseUnknown@@UBEPBDXZ
?IsAKindOf@CATBaseUnknown@@UBEHPBD@Z
?GetImpl@CATBaseUnknown@@UBGPAV1@H@Z
?SetImpl@CATBaseUnknown@@UAGPAV1@PAV1@@Z
?IsNull@CATBaseUnknown@@UBEHXZ
?IsEqual@CATBaseUnknown@@UBEHPBV1@@Z
?ChangeComponentState@CATBaseUnknown@@UAEJW4ComponentState@1@0PBVCATSysChangeComponentStateContext@@@Z
?Tie_Query@@YAJPAUIUnknown@@PAVCATBaseUnknown@@1PAVCATMetaClass@@HABU_GUID@@PAPAX@Z
?Tie_AddRef@@YAKPAVCATBaseUnknown@@W4ENUMTypeOfClass@@PAJ@Z
?Tie_Release@@YAKPAHPAPAVCATBaseUnknown@@PAV1@W4ENUMTypeOfClass@@PAJ@Z
?Tie_GetTypeInfoCount@@YAJPAUIDispatch@@PAVCATMetaClass@@PAI@Z
?Tie_GetTypeInfo@@YAJPAUIDispatch@@PAVCATMetaClass@@IKPAPAUITypeInfo@@@Z
?Tie_GetIDsOfNames@@YAJPAUIDispatch@@PAVCATMetaClass@@ABU_GUID@@PAPAGIKPAJ@Z
?Tie_Invoke@@YAJPAUIDispatch@@PAVCATMetaClass@@JABU_GUID@@KGPAUtagDISPPARAMS@@PAUtagVARIANT@@PAUtagEXCEPINFO@@PAI@Z
??0CATListValCATBaseUnknown_var@@QAE@XZ
??0CATBaseUnknown@@QAE@XZ
?QueryInterface@CATBaseUnknown@@UAGJABU_GUID@@PAPAX@Z
?AddRef@CATBaseUnknown@@UAGKXZ
??0CATRawCollPV@@QAE@ABV0@@Z
?GetTypeInfoCount@CATBaseUnknown@@UAGJPAI@Z
?GetTypeInfo@CATBaseUnknown@@UAGJIKPAPAUITypeInfo@@@Z
?GetIDsOfNames@CATBaseUnknown@@UAGJABU_GUID@@PAPAGIKPAJ@Z
?Invoke@CATBaseUnknown@@UAGJJABU_GUID@@KGPAUtagDISPPARAMS@@PAUtagVARIANT@@PAUtagEXCEPINFO@@PAI@Z
??4CATListValCATBaseUnknown_var@@QAEAAV0@ABV0@@Z
??1CATBaseUnknown_var@@QAE@XZ
??CCATBaseUnknown_var@@QBGPAVCATBaseUnknown@@XZ
??BCATBaseUnknown_var@@QBGPAVCATBaseUnknown@@XZ
??4CATBaseUnknown_var@@QAGAAV0@ABV0@@Z
??ACATListValCATBaseUnknown_var@@QAEAAVCATBaseUnknown_var@@H@Z
??0CATBaseUnknown_var@@QAE@PAVCATBaseUnknown@@@Z
?Size@CATListValCATBaseUnknown_var@@QBEHXZ
?GetClassId@CATMetaClass@@QBGABU_GUID@@XZ
?IsA@CATMetaClass@@QBEPBDXZ
?IsAKindOf@CATMetaClass@@QBEHPBD@Z
?Tie_Construct@@YAPAVCATBaseUnknown@@PAUIUnknown@@PAVCATMetaClass@@PAPAV1@HPAV1@ABU_GUID@@W4ENUMTypeOfClass@@3P6APAV1@XZ32@Z
??3CATBaseUnknown@@SAXPAX@Z
?Run@Tie_StackCtx@@QAEPAVCATBaseUnknown@@PAV2@0@Z
??2CATBaseUnknown@@SAPAXI@Z
?Tie_Link@@YAPAUIUnknown@@PAVCATBaseUnknown@@0ABU_GUID@@@Z
??1CATBaseUnknown@@UAE@XZ
??1CATListValCATBaseUnknown_var@@UAE@XZ
??0CATFillDictionary@@QAE@PBVCATMetaClass@@0PAX1H@Z
?ToCreateBOA@@YAPAUIUnknown@@PAVCATBaseUnknown@@0PAVCATMetaClass@@ABU_GUID@@P6APAV2@XZ@Z
?ReadSetting@CATSettingRepository@@QAEJPBDPAHJ@Z
?GetRepository@CATSettingRepository@@SAPAV1@PBDHW4AccessType@1@PAVCATISysSettingController@@@Z
?SaveRepository@CATSettingRepository@@QAEJPBD@Z
?WriteSetting@CATSettingRepository@@QAEJPBDPAHJH@Z
??0CATRawCollPV@@QAE@H@Z
??9CATRawCollPV@@QBEHABV0@@Z
??8CATRawCollPV@@QBEHABV0@@Z
?RemoveAll@CATRawCollPV@@QAEXW4MemoryHandling@CATCollec@@@Z
?RemoveValue@CATRawCollPV@@QAEHPAX@Z
??ACATRawCollPV@@QBEPAXH@Z
??ACATRawCollPV@@QAEAAPAXH@Z
?Size@CATRawCollPV@@QBEHXZ
??1CATTrace@@QAE@XZ
?Append@CATRawCollPV@@QAEHPAX@Z
?Release@CATBaseUnknown@@UAGKXZ
??0CATTrace@@QAE@QBDQADW4CATTraMode@@0H@Z
catsimulationinterfaces
?ClassId@CATISimDynClash@@SGABU_GUID@@XZ
??1CATISimDynClashFactory@@UAE@XZ
??0CATISimDynClashFactory@@QAE@XZ
?MetaObject@CATISimDynClashFactory@@SGPAVCATMetaClass@@XZ
??0CATISimDynClash@@QAE@XZ
??1CATISimDynClash@@UAE@XZ
?MetaObject@CATISimDynClash@@SGPAVCATMetaClass@@XZ
?IID_CATISimDynClash@@3U_GUID@@A
?IID_CATISimDynClashFactory@@3U_GUID@@A
catnavigatoritf
?ClassId@CATIDMUValidateObject@@SGABU_GUID@@XZ
msvcr80
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_initterm_e
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
_initterm
_encoded_null
free
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
??_V@YAXPAX@Z
??3@YAXPAX@Z
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
IsDebuggerPresent
Exports
Exports
??0CATListPtrCATPathElement@@QAE@ABV0@@Z
??0CATListPtrCATPathElement@@QAE@H@Z
??0CATSimDynClashParm@@AAE@XZ
??1CATListPtrCATPathElement@@UAE@XZ
??1CATSimDynClashParm@@AAE@XZ
??4CATListPtrCATPathElement@@QAEAAV0@ABV0@@Z
??4CATSimDynClashParm@@QAEAAV0@ABV0@@Z
??8CATListPtrCATPathElement@@QBEHABV0@@Z
??9CATListPtrCATPathElement@@QBEHABV0@@Z
??ACATListPtrCATPathElement@@QAEAAPAVCATPathElement@@H@Z
??ACATListPtrCATPathElement@@QBEPAVCATPathElement@@H@Z
??_7CATListPtrCATPathElement@@6B@
??_FCATListPtrCATPathElement@@QAEXXZ
?Append@CATListPtrCATPathElement@@QAEXPAVCATPathElement@@@Z
?GetActuationState@CATSimDynClashParm@@SAJAAW4CATDynClashActuationState@@@Z
?GetRepositoryState@CATSimDynClashParm@@CA?AW4CATDynClashActuationState@@XZ
?RemoveAll@CATListPtrCATPathElement@@QAEXW4MemoryHandling@CATCollec@@@Z
?RemoveDuplicates@CATListPtrCATPathElement@@QAEHPAV1@@Z
?RemoveValue@CATListPtrCATPathElement@@QAEHPAVCATPathElement@@@Z
?SetActuationState@CATSimDynClashParm@@SAJW4CATDynClashActuationState@@@Z
?Size@CATListPtrCATPathElement@@QBEHXZ
?_ActuationState@CATSimDynClashParm@@0W4CATDynClashActuationState@@A
CreateBOACATISimDynClashFactoryCATSimDynClashFactoryImpl
CreateTIECATISimDynClashCATSimDynClash
DASSAULT_SYSTEMES_CAA2_INTERNAL_CATDynClash
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ