d:\cm\build\public\ocp_notification_08_01_06\csi\projects\foundation\services\noser\win\Release\Cod\Notification.pdb
Static task
static1
Behavioral task
behavioral1
Sample
03aa39bc9dffba3500e48dac1f550e9c_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
03aa39bc9dffba3500e48dac1f550e9c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
03aa39bc9dffba3500e48dac1f550e9c_JaffaCakes118
-
Size
244KB
-
MD5
03aa39bc9dffba3500e48dac1f550e9c
-
SHA1
1f7c030ff3b698937c9379c83bcba5d9a0e30e85
-
SHA256
829442e9f53bd9a5e62c70b1e612481870edd9f54ca5fed41ef161263731f13b
-
SHA512
57c9ab787a7572821d7a566fdc583944fe926d7e8ececf4e5ff4f9b05ef950c634a2bf0a6696ddb1712a377522aa744cae46382809f7d9e9f9e52cd6356e4793
-
SSDEEP
6144:3fT8WKcFLbcrQ1m0Ws/eJXfiRzE8WNZsczWZisNj:PTGcFL4rQ1cJ1izSzWsKj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03aa39bc9dffba3500e48dac1f550e9c_JaffaCakes118
Files
-
03aa39bc9dffba3500e48dac1f550e9c_JaffaCakes118.dll windows:4 windows x86 arch:x86
f58b57481a2257a2ce68ace8403e0648
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
OpenProcess
GetLastError
DuplicateHandle
GetCurrentProcess
MapViewOfFile
GetCurrentProcessId
SetEvent
WaitForSingleObject
FreeLibrary
CompareStringA
UnmapViewOfFile
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
SetLastError
InterlockedCompareExchange
GetCurrentThreadId
ResetEvent
DisableThreadLibraryCalls
ExitProcess
InterlockedExchange
ReleaseMutex
user32
TranslateMessage
SetTimer
KillTimer
MsgWaitForMultipleObjects
xprt5
?Replace@TBstr@XPRT@@QAEHPBG0@Z
??0TBstr@XPRT@@QAE@PBDPBG@Z
kSystemEncoding
xprt_iswdigit
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
_XprtAtomicIncrement@4
_XprtAtomicDecrement@4
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
_XprtInitialize@8
_XprtUninitialize@0
?Unlock@TSpinLock@XPRT@@QAEXXZ
?Lock@TSpinLock@XPRT@@QAEXXZ
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
xprt_strcmp
?GetTm@TTime@XPRT@@QBE_NPAUtm@@@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
?GetMinute@TTime@XPRT@@QBEHXZ
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
_XprtMemRealloc@8
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
?ToInt@TBstr@XPRT@@QBEHH@Z
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
?Set@TTime@XPRT@@QAEXN@Z
?GetTickCount@TTime@XPRT@@SA?AV12@XZ
?GetTime64@TTime@XPRT@@QBE_JXZ
?GetAt@TBstr@XPRT@@QBEGH@Z
?Set@TTime@XPRT@@QAEXHHHHHH@Z
?AppendFormat@TBstr@XPRT@@QAAXPBGZZ
?Tokenize@TBstr@XPRT@@QBE?AV12@PBGAAH@Z
?Format@TBstr@XPRT@@QAAXPBGZZ
_XprtGetMilliseconds@0
xprt_wcsncmp
xprt_wcslen
?Insert@TBstr@XPRT@@QAEHHPBG@Z
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?Find@TBstr@XPRT@@QBEHPBGH@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?GetEncodedByteLength@TBstr@XPRT@@QBEHPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBDHPBG@Z
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
_XprtMemAlloc@4
xprt_memset
xprt_memmove
_XprtMemFree@4
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?GetDayOfWeek@TTime@XPRT@@QBEHXZ
?GetYear@TTime@XPRT@@QBEHXZ
?GetMonth@TTime@XPRT@@QBEHXZ
?GetDay@TTime@XPRT@@QBEHXZ
?Format@TTime@XPRT@@QBE?AVTBstr@2@PBG@Z
?GetHour@TTime@XPRT@@QBEHXZ
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
??0TBstr@XPRT@@QAE@XZ
_XprtReleaseMessageId@4
_XprtUnregisterMessageCallback@4
_XprtRegisterMessageCallback@8
_XprtRequestMessageId@0
_XprtGetMessageQueue@0
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
??0TBstr@XPRT@@QAE@PBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??1TBstr@XPRT@@QAE@XZ
?Append@TBstr@XPRT@@QAEAAV12@G@Z
_XprtCreateThread@8
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
msvcrt
qsort
_snwprintf
_except_handler3
__dllonexit
??2@YAPAXI@Z
_onexit
free
_initterm
malloc
_adjust_fdiv
strcmp
memset
_purecall
memmove
memcpy
??3@YAXPAX@Z
memcmp
ole32
CoRegisterMessageFilter
CoUninitialize
CreateBindCtx
CoCreateInstance
CoInitializeEx
oleaut32
VariantClear
VariantCopy
VarCmp
VariantTimeToSystemTime
SysAllocString
VariantChangeType
SystemTimeToVariantTime
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayRedim
SafeArrayCopy
VariantInit
Exports
Exports
EEGetModuleInterop
Sections
.text Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 102KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE