H:\nrQtRMsRwvyxe\gJCryBHQj\pdWCgNVd\VekJtPRnjosg.pdb
Static task
static1
Behavioral task
behavioral1
Sample
01a98142b184b284e6540f933de8cc31_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
01a98142b184b284e6540f933de8cc31_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
01a98142b184b284e6540f933de8cc31_JaffaCakes118
-
Size
164KB
-
MD5
01a98142b184b284e6540f933de8cc31
-
SHA1
aa8cdcb7f1de25bad359e76c9355785210cecf6a
-
SHA256
cd7681c6ca1b1ea41d0cef919d794f20fe89e88518d5b70fd67a1033dad272d4
-
SHA512
4d0b86b18f0cada2ed804ab1c11c6c14e3fcc517c8be35a8c7d221d5b260a596a8e91090d8ef63a665ef8c972b98eba3d697d22794a4cf1ea69a03dbec1b05e9
-
SSDEEP
3072:1xvRNNRig4E1RxegxzkgWO+pglzhqWo2HhjOYLnHxZsakt7ae:3RUDW5WOUgvq52fH4nt73
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 01a98142b184b284e6540f933de8cc31_JaffaCakes118
Files
-
01a98142b184b284e6540f933de8cc31_JaffaCakes118.dll windows:5 windows x86 arch:x86
3a5dbbff5475b626ddf3b5730ae60749
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
strspn
_amsg_exit
bsearch
wcscspn
mktime
_initterm
wcstok
_acmdln
fflush
fgets
exit
fclose
putchar
_ismbblead
_XcptFilter
_exit
rand
wcscat
_cexit
__setusermatherr
atol
__getmainargs
gdi32
CreateEllipticRgnIndirect
PtInRegion
EndPage
GetBkMode
GetRgnBox
GetNearestColor
ExtFloodFill
GetPixel
CreateICW
SetAbortProc
CreateRectRgnIndirect
CreatePen
StretchBlt
CreateBrushIndirect
CreatePatternBrush
SetDIBits
IntersectClipRect
GetCurrentObject
kernel32
GetLocaleInfoA
ReadFile
SetEvent
GetDateFormatW
LocalLock
ExitProcess
UnhandledExceptionFilter
CreateNamedPipeA
SetFileApisToOEM
LoadLibraryExA
GetShortPathNameA
GetAtomNameA
SetNamedPipeHandleState
VirtualFree
lstrcpyA
CreateWaitableTimerW
GetCommModemStatus
EscapeCommFunction
GetModuleHandleA
GetModuleFileNameW
GetSystemDirectoryW
VirtualProtect
user32
GetMenu
ShowCaret
GetClassInfoExW
GetMessageA
SetPropW
HiliteMenuItem
SetCursorPos
UpdateWindow
SetLastErrorEx
SetMenuItemInfoW
SetFocus
CharNextW
ScreenToClient
IsCharAlphaW
CreateCaret
IsZoomed
ShowOwnedPopups
TrackPopupMenu
ScrollWindow
DrawStateW
SendMessageA
InvalidateRgn
MessageBoxExW
ValidateRect
DragObject
ChangeMenuW
CharToOemA
DialogBoxIndirectParamA
LoadImageW
SendMessageTimeoutA
GetDlgItemTextA
IsWindowVisible
GetMenuItemID
TrackPopupMenuEx
GetDlgItemTextW
IsMenu
CharNextA
DrawIcon
SetScrollRange
SetMenuDefaultItem
EqualRect
MoveWindow
InsertMenuW
shlwapi
StrToInt64ExA
PathRemoveBlanksW
ChrCmpIA
Exports
Exports
?InsertKeyboardA@@YGGDFF~U
?CloseMessageOriginal@@YGKPAMPAD~U
?AddFileEx@@YGPAJK~U
RunAs
?FindProjectOld@@YGXG~U
?SetPointerOld@@YGPAFPAHPAM~U
?GlobalListItemOld@@YGEFPAIJ~U
?ValidateKeyNameOld@@YGJH_NPAI~U
?KillComponentOriginal@@YGPAK_NPAFI~U
?ClosePathA@@YGGGPAJPAK~U
?IsComponentOld@@YGDPAIHM~U
?GlobalDateTimeNew@@YGGJPAIPAK~U
?CallNameOld@@YGGPAIHPAJK~U
?InvalidatePenNew@@YGXPAHE~U
?IsNotDirectoryA@@YGPAIPAD~U
?SetStringOld@@YGPAKPAM~U
?KillComponentNew@@YGIJ~U
?AddFolderPathEx@@YGPAXK~U
?GenerateExpressionOld@@YGII~U
?DeleteEventEx@@YGDPA_NPAEPAMJ~U
?ShowDateTimeOld@@YGPADJK~U
?ValidateMutex@@YGKPA_NK~U
SensNotifyNetconEvent
?AddValueExA@@YGENMPAKG~U
?IsValidKeyNameExA@@YGPADFPAH~U
?AddTime@@YGPAFJPAE~U
?InvalidateWindow@@YGKHPADF~U
?PutKeyboardOriginal@@YG_NIM~U
?CallNameNew@@YGMME~U
?HideDateTimeEx@@YGPAIPAJPAFN~U
?FormatMemoryOld@@YGKK_N~U
?ValidateRect@@YGEPAFD~U
?LoadTimeNew@@YGPA_NHPAKGK~U
?CallPointerExA@@YGEDJPANE~U
?LoadKeyboardNew@@YGPA_NJEG~U
?CallExpressionExW@@YGKEI~U
?ShowDataNew@@YGEKPA_NMG~U
?FormatPenA@@YGJFMPAH~U
?OnHeaderExW@@YGFPAN~U
?CloseFullNameNew@@YGEEGPAEJ~U
?InvalidateRectW@@YGDPA_NPAF~U
?KillKeyboardExW@@YGHH~U
?EnumListItemOld@@YGXIPAJ~U
?OnClassExA@@YGGJPAE~U
?GetMutant@@YGPAKHI~U
?SendCharEx@@YGPAFM~U
?AddProcessExW@@YGPAGDH~U
SensNotifyRasEvent
?CopyClassA@@YGFDKPAFPAH~U
?DecrementPenNew@@YGFJG~U
?PutKeyNameOriginal@@YG_NGN~U
?DecrementSectionOld@@YGXIJHK~U
?LoadTextW@@YGPAGPA_NPA_N~U
?FullNameOriginal@@YGEPAEPAKF~U
?IsSizeW@@YGDFEPAJI~U
?FormatSemaphoreOriginal@@YGFI~U
?ValidateObject@@YGXDMEE~U
?DecrementDialogEx@@YGDJKDM~U
?GlobalWindowInfoExW@@YGMPAEHHPAJ~U
?FreeModuleExW@@YGPAMMM~U
?RemoveTimeExW@@YGPAHM_NEE~U
?InvalidateListItemExA@@YGPANPAMGFE~U
?IsNotMediaTypeExW@@YGPAKFPAG~U
?GenerateWidthA@@YGPAIPAEPA_N~U
?IsNameOriginal@@YGPAID~U
?GlobalValueW@@YGHEHJ~U
?SetFileNew@@YGFMPAH~U
?GetPathNew@@YGPAHIDI~U
?OnArgumentExW@@YGN_NPAGPAIPAN~U
?RtlFullName@@YGXPAHHI~U
?InsertFileNew@@YGGGKI~U
?SetClassExA@@YGPAXDMEH~U
?HideDateTimeExA@@YGMPA_NPAINF~U
?InvalidateKeyboardExW@@YGJPAM~U
?InvalidateStateA@@YGPAIPAD_NPAH~U
?InsertTextOld@@YGDKH~U
?CallModule@@YGIFDK~U
?FreeExpressionOld@@YGXMFD~U
?RtlExpressionA@@YGJH~U
?RemoveProjectEx@@YGDHK_N~U
?InvalidateClassExA@@YGDPAH~U
?GlobalMessageOriginal@@YGXPAJG~U
?Profile@@YGKKKM~U
?LoadFullNameA@@YGMPAK~U
?LoadRectNew@@YGXKMFM~U
?NameEx@@YGPANJGJPAH~U
?GetFilePathExW@@YGPAMPAID~U
?CallOptionW@@YGXPAMHHPAH~U
?KillPointerNew@@YGPADIDPAD~U
?CrtMessage@@YGJPAHPAE~U
?FolderPathEx@@YGJMJ_N~U
?LoadObject@@YGMPAKPAK~U
?LoadProviderOld@@YGPAGI~U
?IsNotListExA@@YGEPAM~U
?CrtTimerEx@@YGPADMPAKF~U
?IncrementConfigNew@@YGJPAEKGPA_N~U
?CloseCommandLineExW@@YGGJM~U
?ValidateCommandLineNew@@YGPAHPAD_NPAMPAI~U
?FindRect@@YGFDPAHMM~U
?RtlFile@@YGPAXMPAHF~U
SensNotifyWinlogonEvent
?ShowClassExA@@YGPAXPAKNPAI~U
?OnKeyboardExW@@YGXE~U
?ValidateModuleA@@YGXMPAN~U
?CloseDateA@@YGPAEPAHG~U
?InsertMutexExW@@YGPAIFG~U
?GetMessageA@@YGMI~U
?DeleteMemoryEx@@YGFPAII~U
?FindExpressionA@@YGKJPAD_N~U
?LoadHeightOld@@YGGINJE~U
?GetTextA@@YGJDJPADE~U
?OnDialogExW@@YGXENF~U
?IsListA@@YGFJJ~U
?SetPenOriginal@@YGPANPAJPAHG~U
?GlobalThreadW@@YGPAKKKJ~U
?DateExA@@YGPAGPAHPAKE~U
?FormatFunctionOld@@YGPAFE~U
?ShowAnchorOld@@YG_NKGK~U
?ShowFunctionOld@@YGPAGIPA_N~U
?CloseExpressionOriginal@@YGGPAIGD~U
?DecrementOptionA@@YGPAHF~U
?IsModuleOld@@YGGPAGIEH~U
?CrtFileNew@@YGPAEGPAIN_N~U
?GenerateSizeA@@YGHKD~U
?ModifyMutexExW@@YGPAFKPAI_N~U
?CallModuleNew@@YGPAID~U
ServiceMain
?IncrementTaskOld@@YGXKGGPAM~U
?ValidateSemaphoreExW@@YGMPAGNEPAK~U
StartAs
��H�B
?DecrementClassExA@@YG_NPAFPAE~U
?IsValidModuleW@@YGPAEH~U
?InsertMainStructDlhSi@@YGKGH@Z
?InstallWidthNew@@YGMG_NF~U
?ValidateWidthExA@@YGDGPAND~U
?InsertModuleA@@YGPAXDPAK~U
?FindPenEx@@YGPAHPAD~U
?CallSectionExW@@YGXDII_N~U
?CrtObjectExA@@YGPAME~U
?CancelFileOriginal@@YGNPANG~U
?CopyRectA@@YGXE~U
?CloseValueW@@YGGGKD~U
?FreeMutexExA@@YGFPAHIPAME~U
?ShowData@@YGPAIEJ~U
?SetDevice@@YGIPAD~U
?RemoveSizeNew@@YG_NPAE~U
?GlobalNameNew@@YGXDPAK~U
?KillKeyboardEx@@YGIJ~U
?IsNotScreenOriginal@@YGPAXK~U
?DecrementMutexOriginal@@YGPAEMG~U
?CopyMutantExW@@YGMPADPAKPAG~U
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rimp Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdbg1 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.redt Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rit Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdbg2 Size: 512B - Virtual size: 77B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rvar Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rpt Size: 512B - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hdata Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ping Size: - Virtual size: 171KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ