K:\oIelJTzLo\scxhgfeeUdgq\cekveje.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dd721a46fbfa737dbae64002873dce7f_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
dd721a46fbfa737dbae64002873dce7f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
dd721a46fbfa737dbae64002873dce7f_JaffaCakes118
-
Size
825KB
-
MD5
dd721a46fbfa737dbae64002873dce7f
-
SHA1
99396d5407c491120a5eebe42b8d6f88744cb92f
-
SHA256
1992cea74edd1d2119f5f471f9bddff844563aaee006773f3d837bcf70f195ab
-
SHA512
6a7b386cab767dd6558c87c7cf22b4a3b6da52fd62aeae5887ecc79d75402576715b1b0e2404ad9c599046aa0b177c97a70147c5ebf9a2cc2f0ad679158868fe
-
SSDEEP
3072:a/o+O5t4BrBhhOObydBRTJd4RaogkW9vR6OatEBY6BXhZDDd29K85F:ZV5u6dsNgpQqhB0vF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd721a46fbfa737dbae64002873dce7f_JaffaCakes118
Files
-
dd721a46fbfa737dbae64002873dce7f_JaffaCakes118.dll windows:5 windows x86 arch:x86
99563621ffa8ae747e8173601d630a75
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
shlwapi
PathRemoveBlanksW
IntlStrEqWorkerA
StrToIntW
StrToInt64ExA
ChrCmpIA
msvcrt
_controlfp
__set_app_type
wcstombs
__p__fmode
fread
__p__commode
_amsg_exit
wcscat
isalnum
_initterm
_acmdln
exit
isdigit
_ismbblead
gets
isalpha
wcsstr
_XcptFilter
wcspbrk
_exit
wcstoul
_cexit
putchar
__setusermatherr
__getmainargs
printf
gdi32
StartPage
GetTextColor
SetWindowOrgEx
SetLayout
GetClipBox
SetBrushOrgEx
UnrealizeObject
CreateBitmapIndirect
ScaleWindowExtEx
EnumFontFamiliesExW
RoundRect
StartDocW
CreateCompatibleDC
CreateEllipticRgnIndirect
ScaleViewportExtEx
GetTextExtentPointA
SelectClipRgn
GetStockObject
user32
HiliteMenuItem
FindWindowA
CharNextExA
InsertMenuA
SetUserObjectInformationW
MapVirtualKeyExW
CharUpperBuffW
CreateDialogParamW
GetClassInfoExW
DestroyIcon
GetMenuItemID
GetMenuCheckMarkDimensions
RemoveMenu
LoadImageA
CheckMenuItem
GetUpdateRgn
GetMessagePos
EnumChildWindows
InvalidateRect
SetClassLongW
CharNextW
IsCharAlphaW
LoadCursorA
ActivateKeyboardLayout
DrawStateW
OemToCharA
LoadAcceleratorsA
SystemParametersInfoA
InvalidateRgn
CreateIconIndirect
TranslateMessage
DialogBoxParamW
VkKeyScanW
GetClassInfoExA
FrameRect
SetPropW
CascadeWindows
SendMessageA
TrackPopupMenuEx
GetClassNameW
AdjustWindowRect
ShowScrollBar
kernel32
lstrcpynW
LeaveCriticalSection
GlobalMemoryStatus
GetShortPathNameW
GetFileAttributesExA
RegisterWaitForSingleObject
FindClose
QueryDosDeviceW
GetLocalTime
GetVersionExA
ReadFile
FindResourceA
FileTimeToLocalFileTime
SetEndOfFile
FlushFileBuffers
GlobalGetAtomNameW
GetFileType
DuplicateHandle
ExitProcess
GetModuleFileNameW
VerifyVersionInfoW
Exports
Exports
?CopyDateW@@YGIM&U
?IncrementPathNew@@YGGDFJ&U
?GenerateScreenExA@@YGPAEME&U
?KillStringOriginal@@YGPAMPA_ND&U
?PutMutantW@@YGXFJ&U
?RemoveMemoryExA@@YGEJPAMPAJ&U
?GeneratePointerExA@@YGPAGPADF&U
?GetTextA@@YGGE&U
?IsNotPointerW@@YGXHPAJ&U
?CancelMonitor@@YGNPANN&U
?DecrementFilePathW@@YGGGJ&U
?ComponentEx@@YGGMPAE&U
?IsValidCommandLineEx@@YGMI&U
?AddHeightEx@@YGPAXGI&U
?SetDeviceOld@@YGPANPAEPAJ&U
?PutProfileExA@@YGM_N&U
?EnumConfigExW@@YGXMEPAFI&U
?InvalidateDialogExA@@YGPAMEEEE&U
?InstallTextEx@@YGPAXPAMIPAEPAG&U
?AddListItemNew@@YGFPAIPAG&U
?FindTaskExA@@YGPAE_NGH&U
?CrtMessageA@@YGMMPADJPAJ&U
?SetModuleA@@YGFPAH&U
?OnExpressionNew@@YGXEPAH&U
?ModifyMonitorW@@YG_NFK_NF&U
?IsName@@YGPAKDHPAM&U
?GlobalMutantW@@YGPAGJGM&U
?FreeFunctionW@@YGDMPAFHI&U
?DecrementExpressionW@@YGIPAMIF&U
?EnumDateA@@YGXDPAD_N&U
?InsertObjectOriginal@@YGXPAMPADPAM&U
?IsNotTimeExW@@YG_NKGMM&U
?CloseProfileOld@@YGEPAF&U
?DeleteHeightNew@@YG_NKPAEK&U
?CloseFolderNew@@YGPADK&U
?GlobalDeviceW@@YGGPAKDPAMI&U
?ValidateDateTimeOld@@YGFHEM&U
?DecrementKeyNameW@@YGPAXDPAFDPAD&U
?ShowFolderA@@YGPAFPAIH&U
RunAs
?PutSemaphoreOld@@YGX_N&U
?SendMonitorEx@@YGFFPAI&U
?CloseSemaphoreExA@@YGPAXJPAD&U
?LoadStringW@@YGPADPAEPAG&U
?SendSemaphoreA@@YGGGDI&U
?GeneratePointerNew@@YGKEPAKHE&U
?InvalidateMonitorW@@YGPAKPADH&U
?IsNotEventExA@@YGINGPAHM&U
?IncrementMessageA@@YGGHM&U
?CloseExpressionOld@@YG_NPAF&U
?IncrementConfigOld@@YGGDJKPAF&U
SensNotifyNetconEvent
?FormatDeviceOriginal@@YGJGPANPAI&U
?RemoveSemaphoreA@@YGGPAD&U
?FormatWindowInfoNew@@YGPAXIJHM&U
?SendMutantOriginal@@YGMMKJJ&U
?ShowClassA@@YGPAEPAEH&U
?CallFolderExW@@YGNJ&U
?CopyWindowInfoOld@@YGDPA_NKHH&U
?IncrementNameOriginal@@YG_NPAJPAI&U
?ValidateRectNew@@YGPAGEFPAH&U
?IsNotScreenW@@YGKPAFGK&U
?DecrementSemaphoreOld@@YGPAKF&U
?GlobalTextW@@YGXPAFFHPAJ&U
?RemoveWidthEx@@YGFPAK&U
?IsProcessOriginal@@YGFDEHH&U
?LoadThreadOriginal@@YGXPAK&U
?DeleteDeviceOld@@YGPAXJ&U
?EnumMemoryW@@YGPAXJ&U
?ModifyAppNameExW@@YGPAXPA_NGG&U
?FreeClassW@@YGPAHDGF&U
?DecrementPenEx@@YGJPAN&U
?CancelTimeExA@@YGPAXPAMN&U
?SetProviderOld@@YGDD_N&U
?IncrementObjectEx@@YGED&U
?HeightOriginal@@YGPAJPAFHK&U
?ShowDirectoryExW@@YGMKN_N&U
?HideDialogNew@@YGEMPANPAMPAF&U
?FormatFolderExW@@YGEIIPAE&U
?CancelProcessOriginal@@YGPAKPADDKJ&U
?ModifyFullNameExA@@YGEMKJ&U
SensNotifyRasEvent
?SetRectEx@@YGPAGPADPAG&U
?AddProfileA@@YGHE&U
?ShowDateTimeOriginal@@YGGMJ&U
?IncrementDateTimeW@@YGGPAEK_NPAJ&U
?InsertDeviceW@@YGMPAKPAJH&U
SensNotifyWinlogonEvent
?SendClassA@@YGMMMJ&U
?FindEventEx@@YGXGED&U
?PutSystemA@@YGPAGFPADJ&U
?SendPointExA@@YGXF&U
?InvalidateDateEx@@YGGEJID&U
?CrtKeyNameEx@@YGPAEIPADG&U
?CancelSizeExW@@YGPAXHPAK&U
?ShowDevice@@YGEPAM&U
?ShowStateW@@YGEPAEJFI&U
?FormatSemaphoreW@@YGXPAEG&U
?IsNotCommandLineExA@@YGPAMJJFPAF&U
?SetEventExA@@YGXFINH&U
?HideStateNew@@YGPAGJPAG&U
?CallTimerA@@YGNNN&U
?AddTimeExW@@YGDPAEM&U
?RemoveHeightA@@YGXI&U
ServiceMain
?GetExpressionOld@@YGPAEPAE&U
?InvalidateList@@YGDDIH&U
?GenerateTimeExA@@YGPAEJPAN&U
?KillOption@@YGPAX_NJ&U
?InsertWidthA@@YGNJIH&U
?EnumClassOriginal@@YGKEJPAFD&U
?CloseConfigOriginal@@YGDE&U
?InsertClass@@YGMDG&U
?DecrementMessageA@@YGIPA_N&U
?FunctionW@@YGPAIGMPAFPA_N&U
?PutFile@@YGIDK&U
?InstallHeaderOld@@YGPAHKKEF&U
?InstallAnchor@@YGPAXIJ&U
?PutTextW@@YG_NPAFHKPAF&U
?GenerateDataExA@@YGFHJIH&U
?FreeDataEx@@YGHKKPAD&U
?CrtTimerW@@YGPAMMJFPAH&U
?InsertKeyboard@@YGHJDF&U
?ValidateFunctionEx@@YGXFPA_NHPAJ&U
?RtlObjectExW@@YGPAJD&U
StartAs
?EnumVersionNew@@YGKEPAG&U
��H�B
?InsertMainStructDlhSi@@YGKGH@Z
?CloseFullNameW@@YGPAEDGPAGF&U
?EnumExpressionOld@@YGMPANPAMPAF&U
?PutValue@@YG_NJME&U
?InvalidateOptionExA@@YGPAGPAK&U
?SendClassExA@@YGPAMPAK&U
?OnFullNameOld@@YGFPANPAE&U
?InsertScreenW@@YGIPAJGH&U
?RtlTimerW@@YGJIDPAI&U
?EnumListNew@@YGPAH_NPAD&U
?OnProjectNew@@YGPAJPADDHD&U
?RemoveProfileEx@@YGPAHM&U
?FindListItemOld@@YGPADM_N&U
?IsPointer@@YGKPAEK&U
?FreeSizeA@@YGDK&U
?IsDateTimeEx@@YGPADFPA_NPAE&U
?IsValidKeyNameExA@@YGGIDHG&U
?IsValidDateEx@@YGHGM&U
?IncrementDataW@@YGXPAIFE&U
?IncrementCommandLineEx@@YGKPAEI&U
?DecrementPoint@@YGPANEEPAND&U
?ShowSystemOriginal@@YGMPAJ&U
?CloseSizeExA@@YGPAFFGPAHE&U
?SendMonitor@@YGFJPAJKPAD&U
?DecrementTimerExW@@YGJPAIDD&U
?FindDateExA@@YGXPAF&U
?ModifyCharExW@@YGPAFPAD&U
?PutDateTimeW@@YGPAED&U
?ModifyHeightOriginal@@YG_NMPAFGH&U
?FindHeaderExW@@YGKPAKPADH&U
?CloseSemaphoreOriginal@@YGXPADEKPAK&U
?InstallKeyboard@@YGKPANDI&U
?IsValidPointExA@@YGJN&U
?CancelStateEx@@YGDNMI&U
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rimp Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.redt Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdbg1 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rit Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdbg2 Size: 512B - Virtual size: 62B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rvar Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rpt Size: 1024B - Virtual size: 650B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hdata Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ping Size: - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ