C:\BUILD_AREA\jdk6\control\build\windows-i586\tmp\deploy\common\bin\deploy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
df6ded43660ed66dd0fca9c7afe092d2_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
df6ded43660ed66dd0fca9c7afe092d2_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
df6ded43660ed66dd0fca9c7afe092d2_JaffaCakes118
-
Size
168KB
-
MD5
df6ded43660ed66dd0fca9c7afe092d2
-
SHA1
a4d84f85734daab69c6030a0ec7923812846da14
-
SHA256
3d626bee9dcd9c7ca1066c6f44ae7ebf15b01a4ed0e6562b83e6cc137f15d4b0
-
SHA512
db11c6014465cd4503b272dfea3c495ebfba25513800d78c1179a06a909f0447d84b76928e7feb428d683ad25cb87ab2fa636da5f42bc37ba25d7d52c65ef31d
-
SSDEEP
1536:TgspruAP58TRdek2n60PzRqJ1PvCdfxGXNUStDW8IRxY6VVHIIUHpfJo2USL9dPO:sTfTS1PzRAUStDWV1VVHIIwo2FdPer6I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df6ded43660ed66dd0fca9c7afe092d2_JaffaCakes118
Files
-
df6ded43660ed66dd0fca9c7afe092d2_JaffaCakes118.dll windows:4 windows x86 arch:x86
20f88b49f1405c32758fa2aff7d83bf1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
crypt32
CryptAcquireCertificatePrivateKey
CertGetPublicKeyLength
CertFreeCertificateChain
CertOpenSystemStoreA
CertEnumCertificatesInStore
CertCloseStore
CertGetCertificateChain
CertGetEnhancedKeyUsage
kernel32
InterlockedDecrement
lstrlenW
GetLastError
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
FormatMessageA
ExpandEnvironmentStringsA
SystemTimeToFileTime
GetSystemTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
InterlockedIncrement
DisableThreadLibraryCalls
GetModuleFileNameA
GetCurrentProcess
CloseHandle
GetTempPathA
GetCurrentProcessId
GetSystemDirectoryA
GetWindowsDirectoryA
WideCharToMultiByte
LocalFree
FreeLibrary
lstrlenA
GetModuleHandleA
LoadLibraryA
GetProcAddress
RaiseException
MultiByteToWideChar
user32
GetWindowLongA
GetForegroundWindow
wsprintfA
CharNextA
MessageBoxA
wsprintfW
ExitWindowsEx
GetWindowThreadProcessId
advapi32
CryptGetUserKey
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegFlushKey
CryptCreateHash
CryptSetHashParam
CryptSignHashA
CryptDestroyHash
CryptDestroyKey
RegQueryValueExA
CryptSetKeyParam
CryptGetKeyParam
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetUserNameW
shell32
ShellExecuteA
FindExecutableA
ole32
CoTaskMemFree
CLSIDFromProgID
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
VariantInit
VariantClear
VarUI4FromStr
SysFreeString
wininet
HttpSendRequestA
InternetQueryOptionA
InternetGoOnline
InternetSetOptionA
InternetGetCookieA
InternetSetCookieA
InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetCloseHandle
urlmon
FindMimeFromData
msvcr71
wcscmp
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
_local_unwind2
strstr
realloc
??_U@YAPAXI@Z
_resetstkoflw
_dup
_dup2
_lseek
_tempnam
calloc
__security_error_handler
memset
strtok
fopen
fputs
fclose
remove
malloc
_open
_fstat
_read
_close
_stricmp
_strdup
??_V@YAXPAX@Z
free
wcslen
_except_handler3
?terminate@@YAXXZ
__CppXcptFilter
_purecall
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler
??2@YAPAXI@Z
strncpy
_adjust_fdiv
Exports
Exports
??0BasicPerfHelper@@QAE@ABV0@@Z
??0BasicPerfHelper@@QAE@ABVSystemTime@@AAVNativeLock@@@Z
??0BasicPerfStore@@QAE@ABV0@@Z
??0BasicPerfStore@@QAE@ABVSystemTime@@AAVNativeLock@@@Z
??0DeployPerf@@QAE@ABV0@@Z
??0DeployPerf@@QAE@XZ
??0NativeLock@@IAE@XZ
??0NativeLocker@@QAE@PAVNativeLock@@@Z
??0PerfHelper@@QAE@ABV0@@Z
??0PerfHelper@@QAE@XZ
??0PerfLabel@@QAE@ABV0@@Z
??0PerfLabel@@QAE@XZ
??0PerfLabel@@QAE@_JPBD@Z
??0PerfStore@@QAE@ABV0@@Z
??0PerfStore@@QAE@XZ
??0SystemTime@@QAE@ABV0@@Z
??0SystemTime@@QAE@XZ
??0WinLock@@QAE@XZ
??0WinTime@@QAE@ABV0@@Z
??0WinTime@@QAE@XZ
??1BasicPerfHelper@@UAE@XZ
??1BasicPerfStore@@UAE@XZ
??1DeployPerf@@UAE@XZ
??1NativeLock@@MAE@XZ
??1NativeLocker@@QAE@XZ
??1PerfHelper@@UAE@XZ
??1PerfStore@@UAE@XZ
??1SystemTime@@UAE@XZ
??1WinLock@@UAE@XZ
??1WinTime@@UAE@XZ
??4DeployPerf@@QAEAAV0@ABV0@@Z
??4NativeLocker@@QAEAAV0@ABV0@@Z
??4PerfHelper@@QAEAAV0@ABV0@@Z
??4PerfLabel@@QAEAAV0@ABV0@@Z
??4PerfStore@@QAEAAV0@ABV0@@Z
??4SystemTime@@QAEAAV0@ABV0@@Z
??4WinTime@@QAEAAV0@ABV0@@Z
??_7BasicPerfHelper@@6B@
??_7BasicPerfStore@@6B@
??_7DeployPerf@@6B@
??_7NativeLock@@6B@
??_7PerfHelper@@6B@
??_7PerfStore@@6B@
??_7SystemTime@@6B@
??_7WinLock@@6B@
??_7WinTime@@6B@
?LABEL_BUFFER_SIZE@PerfLabel@@2IB
?MAX_LABEL_COUNT@BasicPerfStore@@0IB
?_get@BasicPerfStore@@ABE?AVPerfLabel@@I@Z
?acquire@WinLock@@UAEXXZ
?calculateJavaEpoch@WinTime@@CA_JXZ
?get@BasicPerfStore@@UBE?AVPerfLabel@@I@Z
?getCurrentTime@BasicPerfHelper@@UBE_JXZ
?getCurrentTime@WinTime@@UBE_JXZ
?getJavaObj@PerfLabel@@QBEPAV_jobject@@PAUJNIEnv_@@@Z
?initStore@BasicPerfHelper@@UAE_NXZ
?labelToString@PerfLabel@@QBEPAV_jstring@@PAUJNIEnv_@@@Z
?put@BasicPerfHelper@@UAEXPAUJNIEnv_@@PAV_jstring@@@Z
?put@BasicPerfHelper@@UAEXPBD@Z
?put@BasicPerfStore@@QAEXPAUJNIEnv_@@PAV_jstring@@@Z
?put@BasicPerfStore@@UAEXPBD@Z
?put@PerfHelper@@MAEXPAUJNIEnv_@@PAV_jstring@@@Z
?release@WinLock@@UAEXXZ
?size@BasicPerfStore@@UBEIXZ
?toArray@BasicPerfHelper@@UBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
?toArray@BasicPerfStore@@QBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
?toArray@PerfHelper@@MBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
GetDeployPerf
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_ExpandEnvironmentStrings@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_FindMimeFromData@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegCloseKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegCreateKeyEx@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegDeleteKey@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegDeleteValue@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegEnumKeyEx@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegEnumValue@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegFlushKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegOpenKey@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegQueryInfoKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegQueryValueEx@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegSetValueEx@20
_Java_com_sun_deploy_config_WinConfig_addRemoveProgramsAdd@36
_Java_com_sun_deploy_config_WinConfig_addRemoveProgramsRemove@16
_Java_com_sun_deploy_config_WinConfig_canDownloadJRE@8
_Java_com_sun_deploy_config_WinConfig_getBrowserPath@8
_Java_com_sun_deploy_config_WinConfig_getPlatformSystemHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_getPlatformUserHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_getSystemExecutableHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_installShortcut@36
_Java_com_sun_deploy_config_WinConfig_isBrowserFireFox@8
_Java_com_sun_deploy_config_WinConfig_isNativeModalDialogUp@8
_Java_com_sun_deploy_config_WinConfig_isPlatformWindowsVista@8
_Java_com_sun_deploy_config_WinConfig_notifyJREInstalled@12
_Java_com_sun_deploy_config_WinConfig_showDocument@12
_Java_com_sun_deploy_net_cookie_IExplorerCookieHandler_getCookieInfo@12
_Java_com_sun_deploy_net_cookie_IExplorerCookieHandler_setCookieInfo@16
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_askUserGoOnline@12
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_isGlobalOffline@8
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_setGlobalOffline@12
_Java_com_sun_deploy_net_proxy_WIExplorerAutoProxyHandler_evalScript@12
_Java_com_sun_deploy_net_proxy_WIExplorerProxyConfig_getBrowserProxySettings@8
_Java_com_sun_deploy_net_proxy_WIExplorerProxyConfig_performAutoDetection@8
_Java_com_sun_deploy_perf_NativePerfHelper_put@12
_Java_com_sun_deploy_perf_NativePerfHelper_toArray@8
_Java_com_sun_deploy_security_MSCredentialManager_decryptMSPassword@12
_Java_com_sun_deploy_security_MSCredentialManager_encryptMSPassword@12
_Java_com_sun_deploy_security_MSCredentialManager_getLoginUID@8
_Java_com_sun_deploy_security_MSCredentialManager_isEncryptionAvailable@8
_Java_com_sun_deploy_security_MSCryptoDSASignature_nativeSignHash@24
_Java_com_sun_deploy_security_MSCryptoNONEwithRSASignature_nativeSignHash@24
_Java_com_sun_deploy_security_MSCryptoRSAKey_cleanUp@16
_Java_com_sun_deploy_security_WIExplorerBrowserAuthenticator14_getAuthentication@12
_Java_com_sun_deploy_security_WIExplorerBrowserAuthenticator_getAuthFromInet@28
_Java_com_sun_deploy_security_WIExplorerCertStore_loadCertificates@20
_Java_com_sun_deploy_security_WIExplorerMyKeyStore_loadKeysAndCertificateChains@16
_Java_com_sun_deploy_security_WSeedGenerator_generateSeed@12
_Java_com_sun_deploy_util_ConsoleHelper_dumpAllStacksImpl@8
_Java_com_sun_deploy_util_ConsoleHelper_preMustangDumpAllStacksImpl@8
_Java_com_sun_deploy_util_WinRegistry_getWindowsDirectory@8
_Java_com_sun_deploy_util_WinRegistry_initIDs@8
_Java_com_sun_deploy_util_WinRegistry_sysCloseKey@12
_Java_com_sun_deploy_util_WinRegistry_sysCreateKey@20
_Java_com_sun_deploy_util_WinRegistry_sysDeleteKey@16
_Java_com_sun_deploy_util_WinRegistry_sysOpenKey@20
_Java_com_sun_deploy_util_WinRegistry_sysQueryKey@16
_Java_com_sun_deploy_util_WinRegistry_sysReboot@8
_Java_com_sun_deploy_util_WinRegistry_sysSetStringValue@20
Sections
.text Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 808B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE