d:\cm\build\public\abPrintAugust_1006\ee_services\addressBookPrint\src\win\Release\abPrintSvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
03556d306eec0e00274bb6d52f90cf49_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
03556d306eec0e00274bb6d52f90cf49_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
03556d306eec0e00274bb6d52f90cf49_JaffaCakes118
-
Size
352KB
-
MD5
03556d306eec0e00274bb6d52f90cf49
-
SHA1
c72ba058d9a6eb55886a795d1441800773adab41
-
SHA256
e0d2e25386d18a20312aa450cd5d5dea5f24017dc4acd9ccc894dba20f4d3362
-
SHA512
e14c30a5b6cad3a7416f452608c3c09273e0d2bdfde02493ba24181c2212efa22f52afa527181fbd258d31b8d1965e7472f0ab5c54ded39f964ccc09fdc9fa11
-
SSDEEP
3072:W9uEzOn/Qsgpn2DcDjHoYGq8nv7vAqHlqLtbaODQl7h25iBsjTZO3ni5AoRgen:djgpn2DcDjIPvp8nHioM3nizZn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03556d306eec0e00274bb6d52f90cf49_JaffaCakes118
Files
-
03556d306eec0e00274bb6d52f90cf49_JaffaCakes118.dll windows:4 windows x86 arch:x86
94113205e1b36dec06802af345446344
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
GetModuleHandleA
GetLastError
SetLastError
DisableThreadLibraryCalls
InterlockedExchange
CompareStringA
ExitProcess
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
CloseHandle
FreeLibrary
GlobalAlloc
GetSystemDefaultLCID
GlobalLock
GlobalUnlock
LoadLibraryA
GlobalFree
user32
SetTimer
KillTimer
TranslateMessage
MsgWaitForMultipleObjects
gdi32
SetMapMode
SelectObject
GetDeviceCaps
AbortDoc
Polyline
EndDoc
StartPage
DeleteDC
SetBkMode
EndPage
DeleteObject
GetCurrentObject
winspool.drv
ClosePrinter
comdlg32
CommDlgExtendedError
ole32
CoCreateInstance
CoUninitialize
CoRegisterMessageFilter
CoInitializeEx
CreateBindCtx
oleaut32
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayRedim
SafeArrayCopy
VariantInit
VariantChangeType
SysAllocString
VariantCopy
VariantClear
SafeArrayDestroy
xprt5
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?CompareNormal@TBstr@XPRT@@QBEHPBG@Z
?AddTail@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
?RemoveHead@TPtrList@XPRT@@QAEPAXXZ
??0TPtrList@XPRT@@QAE@H@Z
??1TPtrList@XPRT@@QAE@XZ
_XprtAtomicIncrement@4
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
xprt_strcmp
xprt_memmove
_XprtMemAlloc@4
_XprtAtomicDecrement@4
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?Lock@TSpinLock@XPRT@@QAEXXZ
?Unlock@TSpinLock@XPRT@@QAEXXZ
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
xprt_iswdigit
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?GetAt@TBstr@XPRT@@QBEGH@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
_XprtInitialize@8
_XprtUninitialize@0
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?Copy@TBstr@XPRT@@QBEPAGXZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
_XprtCreateThread@8
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??0TBstr@XPRT@@QAE@XZ
kSystemEncoding
??0TBstr@XPRT@@QAE@PBDPBG@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
??1TBstr@XPRT@@QAE@XZ
?Compare@TBstr@XPRT@@QBEHPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
?Normalize@TBstr@XPRT@@QAEAAV12@XZ
_XprtGenerateRandom@8
_XprtMemFree@4
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
??0TBstr@XPRT@@QAE@PBG@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
xprt_memset
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
msvcrt
??2@YAPAXI@Z
_adjust_fdiv
_initterm
_onexit
__dllonexit
??3@YAXPAX@Z
malloc
_except_handler3
_purecall
qsort
strcmp
_snwprintf
wcstok
free
memcpy
towupper
isspace
wcslen
swprintf
wcscmp
swscanf
memset
tolower
isupper
Exports
Exports
EEGetModuleInterop
Sections
.text Size: 80KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE