d:\QQLive_dailyBuild\src\symbol\Skin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fc5147fb261653233a7b2efe41ad0e98_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fc5147fb261653233a7b2efe41ad0e98_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fc5147fb261653233a7b2efe41ad0e98_JaffaCakes118
-
Size
132KB
-
MD5
fc5147fb261653233a7b2efe41ad0e98
-
SHA1
c3ea9fc8d945f3c0cdc50261ce2b371c208b5718
-
SHA256
32cb025ae14fc5240a70b15ba04aecd9c5e9717337889a1754d0d45ee6666f5a
-
SHA512
f3d68f8747b9adebef80710b99cea6f7f359c672812e1bfeb53ff932c0813975a19cff469762d3917361b1cf05ab0c8c9e559cace9f58762301d4e10936731ff
-
SSDEEP
3072:iK+tY2+o0zjtDuiKz3EseTrVODJHODcA:intY2dE8fepODh6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fc5147fb261653233a7b2efe41ad0e98_JaffaCakes118
Files
-
fc5147fb261653233a7b2efe41ad0e98_JaffaCakes118.dll windows:4 windows x86 arch:x86
55c7a767c0c45b3395a865fdbd9d61c7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
mfc80u
ord764
ord1168
ord1079
ord1476
ord5558
ord1093
ord762
ord371
ord265
ord283
ord266
ord577
ord1178
ord293
ord2311
msvcr80
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@XZ
memmove_s
fclose
fread
_fileno
_wfopen_s
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
wcstoul
??0exception@std@@QAE@ABV01@@Z
swprintf_s
_invalid_parameter_noinfo
wcsncpy_s
free
_wtoi
_fstat64i32
_lock
_onexit
_decode_pointer
floor
_malloc_crt
_encoded_null
_initterm
_initterm_e
__CxxFrameHandler3
_CxxThrowException
memset
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
kernel32
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GlobalAlloc
GlobalLock
lstrlenA
MultiByteToWideChar
GlobalUnlock
GlobalReAlloc
CreateFileW
GetModuleFileNameW
GetFileSize
ReadFile
CloseHandle
GlobalFree
GetVersionExW
GetModuleHandleW
WideCharToMultiByte
lstrlenW
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
user32
FillRect
GetCursorPos
DrawIconEx
RemovePropW
ReleaseDC
SetWindowRgn
SetWindowLongW
EndPaint
GetDC
BeginPaint
LoadImageW
GetWindowLongW
GetWindow
SendMessageW
GetTopWindow
SetPropW
IsWindowVisible
InvalidateRect
GetClassNameW
GetPropW
GetWindowThreadProcessId
RedrawWindow
IsWindow
SetWindowPos
GetWindowRect
ClientToScreen
GetClientRect
GetWindowRgn
GetDesktopWindow
GetParent
OffsetRect
CallWindowProcW
GetWindowDC
PostMessageW
SendMessageTimeoutW
RegisterWindowMessageW
CreateWindowExW
SetCursor
DrawTextW
IsWindowEnabled
SetRect
GetWindowTextA
GetWindowTextW
WindowFromPoint
ScreenToClient
gdi32
SetBkMode
StretchBlt
Rectangle
SelectObject
FillRgn
CreateDIBSection
RoundRect
CreateCompatibleDC
GetTextExtentPoint32W
GetStockObject
LineTo
SetDIBits
MoveToEx
GetDIBits
CreateSolidBrush
CreatePen
CreateRectRgnIndirect
CreateDIBitmap
CreateRoundRectRgn
ExcludeClipRect
ExtSelectClipRgn
SelectClipRgn
OffsetRgn
GetObjectW
DeleteObject
CreateRectRgn
SetStretchBltMode
SetTextColor
DeleteDC
SetBkColor
CombineRgn
BitBlt
ExtCreateRegion
GetDeviceCaps
CreateBitmap
CreateFontIndirectW
msimg32
GradientFill
comctl32
InitCommonControlsEx
_TrackMouseEvent
oleaut32
SysAllocStringByteLen
SysAllocString
VarBstrCmp
SysFreeString
SysAllocStringLen
SysStringByteLen
msvcp80
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IPB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
Exports
Exports
??0CPicCenter@@QAE@ABV0@@Z
??0CPicCenter@@QAE@XZ
??0CSkinBase@@QAE@ABV0@@Z
??0CSkinBase@@QAE@XZ
??1CPicCenter@@UAE@XZ
??1CSkinBase@@UAE@XZ
??4CPicCenter@@QAEAAV0@ABV0@@Z
??4CSkinBase@@QAEAAV0@ABV0@@Z
??_7CPicCenter@@6B@
??_7CSkinBase@@6B@
?AddClassName@CSkinBase@@QAEJPB_W@Z
?AddRefVar@CSkinBase@@QAEHPB_W@Z
?CheckLockSize@CSkinBase@@IAEJXZ
?CreateSkinControl@@YAPAUHWND__@@PB_WPAU1@H@Z
?DeleteAllPicArray@CSkinBase@@IAEJXZ
?DeletePicArray@CSkinBase@@IAEJAAV?$vector@PAUPICINFO@@V?$allocator@PAUPICINFO@@@std@@@std@@@Z
?DrawGradientRect@@YAXKKAAUtagRECT@@PAUHDC__@@H@Z
?DrawWnd@CSkinBase@@IAEJAAV?$vector@PAUPICINFO@@V?$allocator@PAUPICINFO@@@std@@@std@@HPAUHDC__@@@Z
?FilterMsg@CSkinBase@@IAEJIIJ@Z
?GetCheckSizeMsg@CSkinBase@@SAIXZ
?GetClassNameByIndex@CSkinBase@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H@Z
?GetClassNameCount@CSkinBase@@QAEHXZ
?GetClassNameW@CSkinBase@@QAEJAAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z
?GetClipMsg@CSkinBase@@SAIXZ
?GetColorSchemeChangeMsg@CSkinBase@@SAIXZ
?GetCurPicArray@CSkinBase@@IAEPAV?$vector@PAUPICINFO@@V?$allocator@PAUPICINFO@@@std@@@std@@XZ
?GetCursor@CPicCenter@@QAEJPB_WAAPAUHICON__@@@Z
?GetDrawMsg@CSkinBase@@SAIXZ
?GetFont@CPicCenter@@QAEJPB_W0AAPAUHFONT__@@@Z
?GetFontName@CPicCenter@@QAEJPAUHFONT__@@PAPA_W@Z
?GetLockSizeMsg@CSkinBase@@SAIXZ
?GetOwnerRenderMsg@CSkinBase@@SAIXZ
?GetPic@CPicCenter@@QAEJPB_WAAPAUHBITMAP__@@AAHH@Z
?GetPicEx@@YAHPB_WAAPAUHBITMAP__@@AAUtagPOINT@@AAUtagSIZE@@H@Z
?GetPicEx@CPicCenter@@QAEJPB_W0AAPAUHBITMAP__@@AAHAAUtagPOINT@@AAUtagSIZE@@H@Z
?GetSkinChangeMsg@CSkinBase@@SAIXZ
?GetSkinColor@@YAKPB_WH@Z
?GetSkinColorScheme@@YAXAAH0@Z
?GetSkinCursor@@YAHPB_WAAPAUHICON__@@@Z
?GetSkinFont@@YAPAUHFONT__@@PB_W@Z
?GetSkinPath@@YAHPAPA_W@Z
?GetUpdateMsg@CSkinBase@@SAIXZ
?HookColorSchemeChange@@YAHPAUHWND__@@H@Z
?Init@CSkinBase@@QAEJPAUHWND__@@HPB_W@Z
?IsRefVar@CSkinBase@@QAEHPB_W@Z
?LoadSkinFromFile@@YAHPB_W00@Z
?LockUpdate@CSkinBase@@IAEHH@Z
?ReloadAllPic@CPicCenter@@QAEHXZ
?RemoveAllPic@CPicCenter@@QAEHXZ
?RemoveClassName@CSkinBase@@QAEJXZ
?RemoveSameID@CSkinBase@@IAEJHAAV?$vector@PAUPICINFO@@V?$allocator@PAUPICINFO@@@std@@@std@@@Z
?RenderRichText@@YAHPB_WPAUHDC__@@ABUtagRECT@@HPAUHWND__@@PAUHFONT__@@H@Z
?RenderRichTextNow@@YAHPB_WPAUHDC__@@ABUtagRECT@@2AAUtagSIZE@@PAUHWND__@@PAUHFONT__@@H@Z
?ResetWindowRgn@CSkinBase@@IAEJXZ
?SetAllInOnePic@CPicCenter@@QAEHPB_W0@Z
?SetCursor@CSkinBase@@IAEJAAV?$vector@PAUPICINFO@@V?$allocator@PAUPICINFO@@@std@@@std@@@Z
?SetSkin@CSkinBase@@QAEJPB_W0@Z
?SetSkinColorScheme@@YAXHH@Z
?SetSkinVar@@YAHPB_W0@Z
?SetWndSkin@@YAHPB_WPAUHWND__@@H@Z
?TransRichText2NormalText@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_W@Z
?TransparentBlt2@@YAXPAUHDC__@@HHHH0HHHHI@Z
?Uninit@CSkinBase@@QAEJXZ
?WndProc@CSkinBase@@QAEJIIJ@Z
Sections
.text Size: 88KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ