W:\phefMivKxauzqk\CrshHJyk\fmbryujN.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fbc27bf51f4a8c09bf125251495eaa37_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fbc27bf51f4a8c09bf125251495eaa37_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fbc27bf51f4a8c09bf125251495eaa37_JaffaCakes118
-
Size
776KB
-
MD5
fbc27bf51f4a8c09bf125251495eaa37
-
SHA1
1549642a6a6efb3b6487fae5d295422013872bf3
-
SHA256
505b7fbe85f0f2ed49ad1f70dfa0029e3607771bc31b2bd3377793a3fa810df2
-
SHA512
1f5da05aa11e9f56e6bdaf61009a255fd0716cb58568916cae0b551eb19a34f9333a55a268b10d940675b1350d65b5b9db57890bce627d2864d4da50f9fa2be3
-
SSDEEP
3072:Cz2ZBPds5TByy4YSN4mGCQCLkkOqeZF5UJ+hLaO:WGBFUyynKQCbOlvUJGaO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fbc27bf51f4a8c09bf125251495eaa37_JaffaCakes118
Files
-
fbc27bf51f4a8c09bf125251495eaa37_JaffaCakes118.dll windows:5 windows x86 arch:x86
3071c9673df87a468613d0a1587de2de
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
gdi32
ScaleViewportExtEx
SetWindowOrgEx
ScaleWindowExtEx
GetDeviceCaps
Polygon
SetTextAlign
GetROP2
GetStockObject
CreatePalette
BitBlt
SetViewportExtEx
CreateDiscardableBitmap
ExtTextOutA
Ellipse
GetCharWidth32W
BeginPath
CreateCompatibleBitmap
TextOutW
CreateDIBSection
kernel32
WaitForSingleObjectEx
GetCommProperties
GetStartupInfoW
SetThreadExecutionState
lstrcmpiA
LoadLibraryA
OpenFile
GetCommModemStatus
ExitProcess
GetCurrentThread
CreateDirectoryW
SetLocalTime
SetThreadPriority
CopyFileW
GetDateFormatW
UnmapViewOfFile
DeleteFileW
GetTempFileNameW
EnumResourceLanguagesA
SetNamedPipeHandleState
ResetEvent
LockResource
lstrcmpiW
user32
GetWindowTextA
CreateDialogParamA
IsZoomed
CascadeWindows
SetTimer
GetScrollInfo
FillRect
GetAsyncKeyState
DispatchMessageA
LoadMenuA
GetSystemMetrics
GetScrollRange
SetWindowLongA
DrawEdge
AppendMenuA
GetClassInfoExW
RegisterWindowMessageA
DrawAnimatedRects
GetKeyboardLayoutNameW
IsWindowVisible
SetActiveWindow
CharLowerW
LookupIconIdFromDirectory
ShowCaret
CharToOemA
SetWindowPlacement
DefWindowProcA
MessageBoxExW
TabbedTextOutW
DrawTextW
CharUpperA
RegisterClassExA
SendMessageTimeoutA
ChangeMenuW
GetKeyState
GetDC
CharUpperBuffA
CharNextW
MessageBoxExA
CreateAcceleratorTableW
IsChild
GetMessageTime
GetUserObjectInformationW
SendMessageW
EnableMenuItem
MessageBoxW
advapi32
InitializeSid
IsValidAcl
shlwapi
PathRemoveBlanksW
StrChrNW
msvcrt
_controlfp
fread
towupper
atoi
wcstoul
__set_app_type
__p__fmode
__p__commode
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
puts
strcspn
strerror
free
_XcptFilter
_exit
mbtowc
tolower
_cexit
strspn
printf
__setusermatherr
wcspbrk
__getmainargs
Exports
Exports
?ValidateProfileW@@YGPADPAIG&U
?AddProcessExW@@YGPAJDH&U
?InstallArgumentExW@@YGKKPAHFPAK&U
?IsNotWindowA@@YGPAXJMF&U
?InstallStringNew@@YGMPAJPADIH&U
?ValidateProjectOld@@YGIPAEEIK&U
?CrtDataEx@@YGIFPAK&U
?ShowObject@@YGMKE&U
?InvalidateProfile@@YGPAEPAMEDPA_N&U
?CopyClassW@@YGXD&U
?EnumTextExA@@YGHH&U
?AddDateA@@YGGPAK&U
?RtlProcessExW@@YGDFPAJG&U
?CrtDateTimeExA@@YGJJHF&U
?RemoveRectA@@YGPAGNH&U
?CloseFunctionExW@@YGPADEPA_N&U
?CopyProfileExW@@YGNPAJI&U
?EventA@@YGPAXEIE&U
?GlobalExpressionExW@@YGMG&U
?KillMonitorW@@YGPAGEI&U
?KillArgument@@YGPAGEPAFJH&U
?RemoveFolderPathEx@@YGHPAH&U
?InsertKeyboardOld@@YGJE&U
?FormatPathA@@YGXJKID&U
?DeleteScreenEx@@YGXFKPAGK&U
?OnNameExW@@YGPADPAMPAKPA_N&U
?CrtNameExA@@YGMG&U
?IncrementEvent@@YGII&U
?SetEventOriginal@@YGPAFGIMPAG&U
?InstallScreenExW@@YGMEIPADPAD&U
?InstallSizeW@@YGPAMPA_NPA_NKG&U
RunAs
?FilePathEx@@YGIPAMIEE&U
?CancelWindowOriginal@@YGPAIPAHPAEI_N&U
?IncrementSectionExA@@YGKPAHPAF&U
?InvalidateObjectOriginal@@YGEPANMN&U
?ModifySystemOriginal@@YGMPA_N_NM&U
?CopyPointerA@@YGEK&U
?CrtModuleExA@@YGM_N&U
?SetFolderW@@YGPAMPAFPAFPAIPAG&U
?EnumKeyNameExW@@YGEPA_NPAE&U
?RtlObject@@YGFPAMK&U
?OnCharExA@@YGJPAHJ&U
?CloseMemory@@YGJIMJE&U
?AddProcessNew@@YGJG&U
?ShowMonitorA@@YGNPAE&U
?CrtValueExW@@YGPAKPAK&U
?ModifyFileA@@YGKPAN&U
?EnumMutantW@@YGPAKGJE&U
?GetWidthA@@YGEPAMPAJPAH&U
?InsertWindow@@YGPAGHG&U
?InvalidateFullNameExW@@YGPAJPAGIMI&U
?CloseMonitorExA@@YGH_N&U
?ShowWindowA@@YGMPAHPAEF&U
SensNotifyNetconEvent
?RtlDataOld@@YGJPA_N_NPAM&U
?RemoveValue@@YGE_NJPAK&U
?ClosePathNew@@YGPAKJPAMPAHPAI&U
?AddPathEx@@YGGM&U
?HideEventExA@@YGPAEIJ&U
?ValidateKeyNameA@@YGPAXI&U
?SetTimeOld@@YGFPAGPAN&U
?LoadDirectoryExW@@YGPAFI&U
?IsKeyNameA@@YGDFF&U
?LoadComponentOld@@YGPADIPAMPAFG&U
?CallHeaderNew@@YGDK&U
?CloseHeight@@YGXGEN&U
?GlobalMemoryOriginal@@YG_NM&U
SensNotifyRasEvent
?ShowFullName@@YGFG&U
?InvalidateWindowA@@YGJN_N&U
?FormatClassNew@@YGXPAHPAFPAM&U
?InvalidateObject@@YGGPADPAG&U
?InsertWindowInfoEx@@YGHFPAHEM&U
?HideProfileExA@@YGJHH&U
?CloseProcessExW@@YGPAIPANJ&U
?CloseCharW@@YGGIGPAEI&U
?CrtCommandLineA@@YGEKJPAHJ&U
SensNotifyWinlogonEvent
?OnSystemEx@@YGPAMM&U
?InvalidateMemoryExA@@YGPAKKPAIPAF&U
?LoadFolderNew@@YGXD_NHPAN&U
ServiceMain
?FormatHeightOriginal@@YGHM&U
?IsValidPointOld@@YGGPAFIPAF&U
?KillScreenNew@@YGKPAI&U
?EnumKeyNameExA@@YGE_NNPAD&U
?IsNotProfileW@@YGFF&U
?DeletePenExW@@YGXPADH&U
?InstallExpressionW@@YGPAXPAD&U
?IsValidMessageOriginal@@YGXPAKH_N&U
?SendProfileEx@@YGIFPAMPAI&U
?EnumListItemW@@YGXPAMPAMK&U
?FreeProcessA@@YGKDGD&U
?FindListExW@@YGPAMFPAIPAM&U
?CloseSizeEx@@YGKPAFMH&U
?FindDialogExA@@YGJHIG&U
?ModifyStringEx@@YGDIPAE&U
?ShowFilePathOriginal@@YGJE&U
?SendAnchor@@YGPAJPAHD&U
?InstallPointer@@YGMDPAIPAF&U
?DeleteScreenOld@@YGPAFIPAI&U
?InvalidateObjectEx@@YGXD&U
?CallPathNew@@YGGDMF&U
?OnAppNameExA@@YGPAMGF&U
?KillCharA@@YGEKPAE&U
?LoadOptionA@@YGPAJG&U
?ShowDirectoryExW@@YGPAKGPAKF&U
?GetAppNameW@@YGGPAEHPAJ&U
?CopyOptionExA@@YGPAXING&U
?AddObject@@YGPAXHIKK&U
?GenerateProcessOld@@YGPA_NGF&U
?SendWindowInfoA@@YGX_NIE&U
?IsMutexExA@@YGKIPADK&U
?IncrementConfigExA@@YGFPAEPAJF&U
?IncrementModule@@YGDD&U
?GlobalVersionA@@YGPAENMPAIK&U
?InvalidateTaskOld@@YGGIHPAJ&U
?CrtMutantW@@YGGD&U
?RemoveDateEx@@YGDDN&U
?DeleteDateTimeOld@@YGKKPAGM&U
?EnumPathOriginal@@YGKF&U
?ShowMemoryEx@@YGKIPAD&U
?CancelDirectoryNew@@YGJGPAFPAM&U
?EnumModuleOld@@YGHIK&U
?InvalidateSystemExW@@YGDPAIPAG&U
?GetFileOld@@YGPAMPAGFKPAH&U
?RemoveProcessW@@YGHPAIPAKPAM&U
?GetSystemEx@@YGEPAFPAKJM&U
?FreeRectOld@@YGHN&U
?LoadNameA@@YGE_NPAKPAKPAG&U
?IsNotMediaTypeExW@@YGPAXDN&U
?RemoveNameA@@YGNK&U
?DeleteStateA@@YG_ND&U
?EnumModuleEx@@YGMJEF&U
?OnExpressionW@@YGPAMMNPA_N&U
?DeleteOption@@YGPAXIJ&U
?DecrementModuleNew@@YGDPA_NPAK&U
?DecrementFileEx@@YGXPAHPAFEI&U
?FindFullNameExW@@YGDPAEF&U
?CrtProviderNew@@YGPAJJ_NH&U
?InstallConfigA@@YGFE_NK&U
StartAs
?GlobalFolderPathOriginal@@YGPAK_N&U
?GlobalVersionNew@@YGPADFGGPAF&U
?SetTextEx@@YGDJIDI&U
?InvalidateSectionOld@@YGPAMHJDM&U
?CopySystemEx@@YGMPAJ&U
��H�B
?InvalidatePath@@YGX_NPAMPAK&U
?FilePathOriginal@@YG_NEDJ&U
?GenerateOption@@YGNPAGPAIDPAJ&U
?CrtMessageEx@@YGNPAGFKI&U
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stit Size: 1024B - Virtual size: 532B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.simp Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.set Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dbg Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dvar Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dpt Size: 1024B - Virtual size: 596B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 512B - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dbug Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ