msvcm80.i386.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f6f817841ea494505c0e84580d0ec3ea_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f6f817841ea494505c0e84580d0ec3ea_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f6f817841ea494505c0e84580d0ec3ea_JaffaCakes118
-
Size
446KB
-
MD5
f6f817841ea494505c0e84580d0ec3ea
-
SHA1
69a33654d78e16d8130594539aac68ca0e7cc786
-
SHA256
8c97441f3f93b8fad0144306116d87e8d753fb97542549243d7cc1eb5620a64d
-
SHA512
9bd6a4055068b20f956974fa7ddfc12e739601c914b22e70e06ed5dc2a692f6e077e12678345bca5472560768e69f604f0d10e22d30c890a7cdc0bb5954d912e
-
SSDEEP
6144:C6KTZsHDwx0TCAQpFTfnPyrerCqq/KruohQFHCxrgtaoOjMQld:4sHDG0TMAxKFhQRCxrcQj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6f817841ea494505c0e84580d0ec3ea_JaffaCakes118
Files
-
f6f817841ea494505c0e84580d0ec3ea_JaffaCakes118.dll windows:4 windows x86 arch:x86
83e6ecedcb8a69cca8d85e1481140fa0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcr80
__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
__setusermatherr
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_query_new_handler@@YAP6AHI@ZXZ
signal
_invalid_parameter
_errno
_set_invalid_parameter_handler
_get_invalid_parameter_handler
?set_terminate@@YAP6AXXZP6AXXZ@Z
_get_terminate
_set_purecall_handler
_get_purecall_handler
?set_unexpected@@YAP6AXXZP6AXXZ@Z
_get_unexpected
_fpieee_flt
_cexit
strcpy_s
strlen
_exit
_XcptFilter
_endthread
_freefls
___fls_setvalue@8
___fls_getvalue@4
__get_flsindex
__set_flsgetvalue
_dosmaperr
_initptd
calloc
_endthreadex
memcpy_s
wcslen
memcmp
memchr
memmove_s
memset
??_V@YAXPAX@Z
_malloc_crt
_invoke_watson
_CxxThrowException
??2@YAPAXI@Z
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
abort
fgetc
fputc
ungetc
fflush
setvbuf
fwrite
fgetpos
fseek
fsetpos
fclose
__iob_func
fgetwc
fputwc
ungetwc
localeconv
??_U@YAPAXI@Z
realloc
setlocale
strcspn
_strtoi64
_strtoui64
sprintf_s
_Gettnames
_Strftime
_Getdays
_Getmonths
___lc_handle_func
strtod
__crtGetStringTypeW
__pctype_func
___mb_cur_max_l_func
___lc_codepage_func
__crtLCMapStringW
__crtCompareStringA
___lc_collate_cp_func
__crtLCMapStringA
memcpy
__crtCompareStringW
_fsopen
wcstombs_s
_wfsopen
_get_osplatform
mbstowcs_s
fputs
__uncaught_exception
isupper
islower
towlower
towupper
strcmp
__FrameUnwindFilter
tolower
isspace
isdigit
isalnum
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
??3@YAXPAX@Z
_ui64toa_s
_create_locale
malloc
_free_locale
_invalid_parameter_noinfo
free
kernel32
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
GetLocaleInfoA
CreateThread
ResumeThread
GetLastError
ExitThread
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
ole32
CoCreateInstance
mscoree
CorBindToRuntimeEx
_CorDllMain
Exports
Exports
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?_Addstd@ios_base@std@@SAXPAV12@@Z
?_Atexit@@YAXP6AXXZ@Z
?_BADOFF_func@std@@YAABJXZ
?_Cerr_func@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@XZ
?_Cin_func@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@XZ
?_Clocptr_func@_Locimp@locale@std@@CAAAPAV123@XZ
?_Clog_func@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@XZ
?_Cosh@@YANNN@Z
?_Cout_func@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@XZ
?_Debug_message@std@@YAXPBD0@Z
?_Dnorm@@YAFPAG@Z
?_Dscale@@YAFPANJ@Z
?_Dtentox@@YANNJPAH@Z
?_Dtest@@YAFPAN@Z
?_Dunscale@@YAFPAFPAN@Z
?_Exp@@YAFPANNF@Z
?_FCosh@@YAMMM@Z
?_FDnorm@@YAFPAG@Z
?_FDscale@@YAFPAMJ@Z
?_FDtentox@@YAMMJPAH@Z
?_FDtest@@YAFPAM@Z
?_FDunscale@@YAFPAFPAM@Z
?_FExp@@YAFPAMMF@Z
?_FSinh@@YAMMM@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Fpz_func@std@@YAAA_JXZ
?_Getcoll@@YA?AU_Collvec@@XZ
?_Getctype@@YA?AU_Ctypevec@@XZ
?_Getcvt@@YA?AU_Cvtvec@@XZ
?_Getdateorder@@YAHXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Getwctype@@YAFGPBU_Ctypevec@@@Z
?_Getwctype@@YAF_WPBU_Ctypevec@@@Z
?_Getwctypes@@YAPBGPBG0PAFPBU_Ctypevec@@@Z
?_Getwctypes@@YAPB_WPB_W0PAFPBU_Ctypevec@@@Z
?_Id_cnt_func@id@locale@std@@CAAAHXZ
?_Id_func@?$codecvt@GDH@std@@SAAAVid@locale@2@XZ
?_Id_func@?$codecvt@_WDH@std@@SAAAVid@locale@2@XZ
?_Id_func@?$ctype@D@std@@SAAAVid@locale@2@XZ
?_Id_func@?$ctype@G@std@@SAAAVid@locale@2@XZ
?_Id_func@?$ctype@_W@std@@SAAAVid@locale@2@XZ
?_Index_func@ios_base@std@@CAAAHXZ
?_Init@locale@std@@CAPAV_Locimp@12@XZ
?_Init_cnt_func@Init@ios_base@std@@CAAAHXZ
?_Init_ctor@Init@ios_base@std@@CAXPAV123@@Z
?_Init_dtor@Init@ios_base@std@@CAXPAV123@@Z
?_Init_locks_ctor@_Init_locks@std@@CAXPAV12@@Z
?_Init_locks_dtor@_Init_locks@std@@CAXPAV12@@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
?_LCosh@@YAOOO@Z
?_LDscale@@YAFPAOJ@Z
?_LDtentox@@YAOOJPAH@Z
?_LDtest@@YAFPAO@Z
?_LDunscale@@YAFPAFPAO@Z
?_LExp@@YAFPAOOF@Z
?_LPoly@@YAOOPBOH@Z
?_LSinh@@YAOOO@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?_Locimp_ctor@_Locimp@locale@std@@CAXPAV123@ABV123@@Z
?_Locimp_dtor@_Locimp@locale@std@@CAXPAV123@@Z
?_Locinfo_Addcats@_Locinfo@std@@SAAAV12@PAV12@HPBD@Z
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@HPBD@Z
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z
?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z
?_Lockit_ctor@_Lockit@std@@CAXPAV12@@Z
?_Lockit_ctor@_Lockit@std@@CAXPAV12@H@Z
?_Lockit_ctor@_Lockit@std@@SAXH@Z
?_Lockit_dtor@_Lockit@std@@CAXPAV12@@Z
?_Lockit_dtor@_Lockit@std@@SAXH@Z
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?_Makeushloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z
?_Makewloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z
?_Makexloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z
?_Mbrtowc@@YAHPAGPBDIPAHPBU_Cvtvec@@@Z
?_Mbrtowc@@YAHPA_WPBDIPAHPBU_Cvtvec@@@Z
?_Mtxdst@@YAXPAU_RTL_CRITICAL_SECTION@@@Z
?_Mtxinit@@YAXPAU_RTL_CRITICAL_SECTION@@@Z
?_Mtxlock@@YAXPAU_RTL_CRITICAL_SECTION@@@Z
?_Mtxunlock@@YAXPAU_RTL_CRITICAL_SECTION@@@Z
?_Mutex_Lock@_Mutex@std@@CAXPAV12@@Z
?_Mutex_Unlock@_Mutex@std@@CAXPAV12@@Z
?_Mutex_ctor@_Mutex@std@@CAXPAV12@@Z
?_Mutex_dtor@_Mutex@std@@CAXPAV12@@Z
?_Nomemory@std@@YAXXZ
?_Once@@YAXPAJP6AXXZ@Z
?_Poly@@YANNPBNH@Z
?_Setgloballocale@locale@std@@CAXPAX@Z
?_Sinh@@YANNN@Z
?_Stod@@YANPBDPAPADJ@Z
?_Stodx@@YANPBDPAPADJPAH@Z
?_Stof@@YAMPBDPAPADJPAH@Z
?_Stoflt@@YAHPBD0PAPADQAJH@Z
?_Stofx@@YAMPBDPAPADJPAH@Z
?_Stold@@YAOPBDPAPADJPAH@Z
?_Stoldx@@YAOPBDPAPADJPAH@Z
?_Stolx@@YAJPBDPAPADHPAH@Z
?_Stopfx@@YAHPAPBDPAPAD@Z
?_Stoul@@YAKPBDPAPADH@Z
?_Stoulx@@YAKPBDPAPADHPAH@Z
?_Stoxflt@@YAHPBD0PAPADQAJH@Z
?_Strcoll@@YAHPBD000PBU_Collvec@@@Z
?_Strxfrm@@YAIPAD0PBD1PBU_Collvec@@@Z
?_Sync_func@ios_base@std@@CAAA_NXZ
?_Throw@std@@YAXABVexception@stdext@@@Z
?_Tolower@@YAHHPBU_Ctypevec@@@Z
?_Toupper@@YAHHPBU_Ctypevec@@@Z
?_Towlower@@YAGGPBU_Ctypevec@@@Z
?_Towlower@@YA_W_WPBU_Ctypevec@@@Z
?_Towupper@@YAGGPBU_Ctypevec@@@Z
?_Towupper@@YA_W_WPBU_Ctypevec@@@Z
?_Wcerr_func@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@XZ
?_Wcerr_func@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@XZ
?_Wcin_func@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@1@XZ
?_Wcin_func@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@1@XZ
?_Wclog_func@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@XZ
?_Wclog_func@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@XZ
?_Wcout_func@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@XZ
?_Wcout_func@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@XZ
?_Wcrtomb@@YAHPADGPAHPBU_Cvtvec@@@Z
?_Wcrtomb@@YAHPAD_WPAHPBU_Cvtvec@@@Z
?_Wcscoll@@YAHPBG000PBU_Collvec@@@Z
?_Wcscoll@@YAHPB_W000PBU_Collvec@@@Z
?_Wcsxfrm@@YAIPAG0PBG1PBU_Collvec@@@Z
?_Wcsxfrm@@YAIPA_W0PB_W1PBU_Collvec@@@Z
?_Xfsopen@std@@YAPAU_iobuf@@PB_W0H@Z
?_Xinvarg@_String_base@std@@SAXXZ
?_Xlen@_String_base@std@@SAXXZ
?_Xran@_String_base@std@@SAXXZ
?__Stodx@@YANPBDPAPADJPAH@Z
?__Stofx@@YAMPBDPAPADJPAH@Z
?__Stoldx@@YAOPBDPAPADJPAH@Z
?__Wcrtomb_lk@@YAHPAD_WPAHPBU_Cvtvec@@@Z
?__get_default_appdomain@@YAJPAPAUIUnknown@@@Z
?__query_new_handler_m@@YAP6MHI@ZXZ
?__release_appdomain@@YAXPAUIUnknown@@@Z
?_beginthread@@YAIP6MXPAX@ZI0@Z
?_beginthreadex@@YAIPAXIP6MI0@Z0IPAI@Z
?_fpieee_flt@@YAHKPAU_EXCEPTION_POINTERS@@P6MHPAU_FPIEEE_RECORD@@@Z@Z
?_set_invalid_parameter_handler@@YAP6AXPB_W00II@ZH@Z
?_set_invalid_parameter_handler@@YAP6MXPB_W00II@ZP6MX000II@Z@Z
?_set_new_handler@@YAP6MHI@ZP6MHI@Z@Z
?_set_purecall_handler@@YAP6AXXZH@Z
?_set_purecall_handler@@YAP6MXXZP6MXXZ@Z
?_uncaught_exception_m@std@@YA_NXZ
?classic@locale@std@@SAABV12@XZ
?empty@locale@std@@SA?AV12@XZ
?facet_Register@facet@locale@std@@CAXPAV123@@Z
?global@locale@std@@SA?AV12@ABV12@@Z
?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z
?set_new_handler@std@@YAP6MXXZP6MXXZ@Z
?set_terminate@@YAP6MXXZP6MXXZ@Z
?set_unexpected@@YAP6MXXZP6MXXZ@Z
?setbase@std@@YA?AU?$_Smanip@H@1@H@Z
?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z
?setprecision@std@@YA?AU?$_Smanip@H@1@H@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?signal@@YAP6MXH@ZHH@Z
?signal@@YAP6MXH@ZHP6MXH@Z@Z
__setusermatherr_m
towctrans
wctrans
wctype
Sections
.text Size: 160KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 280KB - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ