ShapeCollector.pdb
Static task
static1
Behavioral task
behavioral1
Sample
00ccc8b8df9458c7d4a49fc1abb20f0d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
00ccc8b8df9458c7d4a49fc1abb20f0d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
00ccc8b8df9458c7d4a49fc1abb20f0d_JaffaCakes118
-
Size
646KB
-
MD5
00ccc8b8df9458c7d4a49fc1abb20f0d
-
SHA1
6779262b61eca7103f3f331618d6a15f40800a95
-
SHA256
f424c9f526c2575de607a1fff807b09ee6a9b735ed53bf843ed69aa450ccf126
-
SHA512
def9d1afe04a704a7a6c37a41e5ee91a88e1d1896e7f8628340d24ee8ba6b3b155536419e44d5050ebb49feb7ca7b5d2dfc1cff571c958148f09e5009d77cf42
-
SSDEEP
6144:U6i38kpQECJZUv6Y2pxrpcqbF9ymCzuja66z7TN/bJo0uR9gpC1RjDksOoFOkcif:UtCJZUvQaqFb6LN9MSo5Xwwj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00ccc8b8df9458c7d4a49fc1abb20f0d_JaffaCakes118
Files
-
00ccc8b8df9458c7d4a49fc1abb20f0d_JaffaCakes118.exe windows:6 windows x86 arch:x86
a70555189f11faf36225ab4e28402c02
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
DrawIcon
RegisterClassExW
BeginPaint
EndPaint
GetSysColorBrush
GetClientRect
DrawTextW
GetWindowLongW
SetWindowPos
GetSysColor
LoadCursorW
SetCursor
UpdateWindow
CreateWindowExW
GetDC
ReleaseDC
DestroyWindow
DefWindowProcW
PostThreadMessageW
ShowWindow
KillTimer
LoadImageW
PostMessageW
GetParent
InvalidateRect
RemovePropW
GetWindowRect
ActivateKeyboardLayout
GetKeyboardLayoutList
SetPropW
SetActiveWindow
SetForegroundWindow
GetSystemMetrics
AllowSetForegroundWindow
GetKeyboardLayout
UnregisterClassW
SetTimer
CallWindowProcW
PostQuitMessage
LoadStringW
SetWindowLongW
SendMessageW
SystemParametersInfoW
LoadIconW
DestroyIcon
MsgWaitForMultipleObjects
IsWindowUnicode
GetMessageA
PeekMessageW
EnableWindow
DispatchMessageA
CharUpperW
DispatchMessageW
TranslateMessage
GetMessageW
CharNextW
UnregisterClassA
msvcrt
?what@exception@@UBEPBDXZ
_purecall
__CxxFrameHandler3
memset
malloc
free
_controlfp
_errno
realloc
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
wcscpy_s
memcpy
??0exception@@QAE@XZ
isdigit
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
_CxxThrowException
_callnewh
__wgetmainargs
_cexit
swprintf_s
isalpha
wcschr
wcsstr
_ftol2_sse
ceil
wcscspn
memcpy_s
_wcsicmp
memmove_s
wcsncpy_s
wcscat_s
_wtoi
_vsnwprintf
__RTDynamicCast
_vscwprintf
vswprintf_s
iswspace
wcsspn
cryptsp
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextW
ole32
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitialize
CLSIDFromString
CoCreateGuid
CoCreateFreeThreadedMarshaler
CoRevokeClassObject
StringFromGUID2
CoTaskMemFree
CoRegisterClassObject
comctl32
ord345
PropertySheetW
oleaut32
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
VariantChangeType
SafeArrayCreateVector
SafeArrayDestroy
OleCreatePictureIndirect
SafeArrayAccessData
SafeArrayUnaccessData
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
VarUI4FromStr
RegisterTypeLi
SysFreeString
shell32
Shell_NotifyIconW
CommandLineToArgvW
ShellExecuteExW
wer
WerReportSetParameter
WerReportAddFile
WerReportCloseHandle
WerReportSubmit
WerReportCreate
rpcrt4
UuidToStringW
UuidCreate
RpcStringFreeW
UuidFromStringW
gdi32
CreateFontIndirectW
GetTextExtentPoint32W
TextOutW
CreatePen
SelectObject
RoundRect
GetStockObject
GdiGradientFill
MoveToEx
LineTo
CreateFontW
GetTextMetricsW
SetBkMode
SetTextColor
DeleteObject
GetDeviceCaps
dui70
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?Add@Element@DirectUI@@QAEJPAV12@@Z
?SetAccState@Element@DirectUI@@QAEJH@Z
?Create@Button@DirectUI@@SGJPAVElement@2@PAKPAPAV32@@Z
?SetClass@Element@DirectUI@@QAEJPBG@Z
?SetActive@Element@DirectUI@@QAEJH@Z
?Release@Element@DirectUI@@QAGKXZ
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?GetSelected@Element@DirectUI@@QAE_NXZ
?Create@FlowLayout@DirectUI@@SGJ_NIIIPAPAVLayout@2@@Z
?GetMaxLength@Edit@DirectUI@@QAEHXZ
?SetDataEntry@PText@DirectUI@@QAEXPAUIDataEntry@2@@Z
?SetFontFace@Element@DirectUI@@QAEJPBG@Z
?SetDirection@Element@DirectUI@@QAEJH@Z
?SetAccDesc@Element@DirectUI@@QAEJPBG@Z
?SetAccName@Element@DirectUI@@QAEJPBG@Z
?OnWizFinish@TaskPage@DirectUI@@MAEJXZ
?Click@Button@DirectUI@@SG?AVUID@@XZ
?GetID@Element@DirectUI@@QAEGXZ
?Create@Element@DirectUI@@SGJIPAV12@PAKPAPAV12@@Z
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?SetMaxLength@Edit@DirectUI@@QAEJH@Z
?GetClass@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetParent@Element@DirectUI@@QAEPAV12@XZ
?GetElement@TaskPage@DirectUI@@IAEPAVElement@2@XZ
?GetIndex@Element@DirectUI@@QAEHXZ
?OnKillActive@TaskPage@DirectUI@@MAEJXZ
??0TaskPage@DirectUI@@QAE@XZ
?SetSelected@Element@DirectUI@@QAEJ_N@Z
?OnMessage@TaskPage@DirectUI@@MAE_NIIJPAJ@Z
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
StrToID
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?Release@Value@DirectUI@@QAEXXZ
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QAEJPAUHINSTANCE__@@@Z
?DestroyCP@TaskPage@DirectUI@@EAEXXZ
?CreateParserCP@TaskPage@DirectUI@@EAEJPAPAVDUIXmlParser@2@@Z
?SetNotifyHandler@CCBase@DirectUI@@QAEXP6GHIIJPAJPAX@Z1@Z
?SetWidth@Element@DirectUI@@QAEJH@Z
?CreateDUICP@TaskPage@DirectUI@@EAEJPAVHWNDElement@2@PAUHWND__@@1PAPAVElement@2@PAPAVDUIXmlParser@2@@Z
?OnReset@TaskPage@DirectUI@@MAEJXZ
?InitPropSheetPage@TaskPage@DirectUI@@MAEXPAU_PROPSHEETPAGEW@@@Z
?LoadPage@TaskPage@DirectUI@@MAEJPAVHWNDElement@2@PAUHINSTANCE__@@PAPAVElement@2@PAPAVDUIXmlParser@2@@Z
?LoadParser@TaskPage@DirectUI@@MAEJPAPAVDUIXmlParser@2@@Z
?OnListenedInput@TaskPage@DirectUI@@MAEXPAVElement@2@PAUInputEvent@2@@Z
?OnListenedPropertyChanged@TaskPage@DirectUI@@MAEXPAVElement@2@PBUPropertyInfo@2@HPAVValue@2@2@Z
?OnListenedPropertyChanging@TaskPage@DirectUI@@MAE_NPAVElement@2@PBUPropertyInfo@2@HPAVValue@2@2@Z
?OnListenerDetach@TaskPage@DirectUI@@MAEXPAVElement@2@@Z
?OnListenerAttach@TaskPage@DirectUI@@MAEXPAVElement@2@@Z
??1TaskPage@DirectUI@@UAE@XZ
??1IDataEntry@DirectUI@@UAE@XZ
??0IDataEntry@DirectUI@@QAE@XZ
?Register@HWNDHost@DirectUI@@SGJXZ
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
??1CritSecLock@DirectUI@@QAE@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Initialize@HWNDHost@DirectUI@@QAEJIIPAVElement@2@PAK@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?GetLayoutPos@Element@DirectUI@@QAEHXZ
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
??1HWNDHost@DirectUI@@UAE@XZ
??1ClassInfoBase@DirectUI@@UAE@XZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
??0ClassInfoBase@DirectUI@@QAE@XZ
?GetClassInfoPtr@HWNDHost@DirectUI@@SGPAUIClassInfo@2@XZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?EraseBkgnd@HWNDHost@DirectUI@@MAE_NPAUHDC__@@PAJ@Z
?SetWindowDirection@HWNDHost@DirectUI@@UAEXPAUHWND__@@@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UAEXIPBUtagSTYLESTRUCT@@@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
InitProcessPriv
UnInitProcessPriv
InitThread
UnInitThread
?PropSheet_SendMessage@TaskPage@DirectUI@@IAEJIIJ@Z
?GetParentHWND@TaskPage@DirectUI@@QAEPAUHWND__@@XZ
??BTaskPage@DirectUI@@QAEPAU_PSP@@XZ
??0HWNDHost@DirectUI@@QAE@XZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@HWNDHost@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnInput@HWNDHost@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnDestroy@HWNDHost@DirectUI@@UAEXXZ
?Paint@HWNDHost@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?MessageCallback@HWNDHost@DirectUI@@UAEIPAUtagGMSG@@@Z
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?OnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?OnUnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UAE_NXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UAEJPAPAUIAccessible@@@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?GetHWND@HWNDHost@DirectUI@@UAEPAUHWND__@@XZ
?OnNotify@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnMessage@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSysChar@HWNDHost@DirectUI@@UAE_NG@Z
ntdll
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwLogTraceEvent
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwUnregisterTraceGuids
kernel32
WaitForMultipleObjects
GetTempFileNameW
WriteFile
CreateFileW
GetTempPathW
GetFileAttributesW
FoldStringW
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
HeapFree
GetProcessHeap
HeapAlloc
CreateProcessW
GetUserDefaultUILanguage
SetLastError
FreeResource
ResetEvent
HeapSetInformation
RegisterApplicationRestart
GetLocaleInfoW
SetLocaleInfoW
GlobalFree
LocalFree
GetCommandLineW
LoadLibraryExW
CreateEventW
CreateThread
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WaitForSingleObject
CloseHandle
ExpandEnvironmentStringsW
LoadLibraryW
FreeLibrary
OutputDebugStringA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
lstrcmpiW
lstrlenW
GetLastError
MultiByteToWideChar
InterlockedExchange
SetEvent
HeapDestroy
HeapReAlloc
HeapSize
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExW
GetModuleHandleW
GetProcAddress
msvcp60
??0out_of_range@std@@QAE@ABV01@@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??0?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAK@Z
??_D?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??0logic_error@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
api-ms-win-core-localregistry-l1-1-0
RegSetValueExW
RegEnumKeyExW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegNotifyChangeKeyValue
RegGetValueW
Sections
.text Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 371KB - Virtual size: 370KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ