R:\hlYzXLG\XXdSiuSnpx\itSWlfzDab\Yfrkqlezk\mnizaDjKfwK.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0c5ed6d992c7ce93a6837e04abedf928_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
0c5ed6d992c7ce93a6837e04abedf928_JaffaCakes118
-
Size
169KB
-
MD5
0c5ed6d992c7ce93a6837e04abedf928
-
SHA1
8744416f9ce7c21928b3eb571be96790d593a4a3
-
SHA256
dc673c05560791a7e30c023e919bee916aec30b2c490cef84da743544b0eb97e
-
SHA512
30eb7d7276e34f87dfa0c756c4c5b90dc72800170be3ed5ad1d30aa99f3f951d8489d295c623b5eb512f6bebdd5ebed9107979e12f9ef549b7ff2ead24f95e96
-
SSDEEP
3072:6fv8q1eZ01OOBVA2ryD3yHU1wsfKIngw7lEJ5TOJ0Ct1l/r:BZOoOH2w8KI2J5yuuv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c5ed6d992c7ce93a6837e04abedf928_JaffaCakes118
Files
-
0c5ed6d992c7ce93a6837e04abedf928_JaffaCakes118.dll windows:5 windows x86 arch:x86
8e29315426ada6976356bb42b1164965
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
wcscspn
fputc
_amsg_exit
iswctype
fgets
_initterm
_acmdln
wcscat
exit
_ismbblead
_XcptFilter
isspace
getc
strncmp
_exit
iswdigit
putc
localtime
_cexit
__setusermatherr
__getmainargs
strcoll
comctl32
DestroyPropertySheetPage
ImageList_Write
PropertySheetA
ImageList_GetIcon
CreateStatusWindowW
user32
GetDlgItem
GetFocus
CreatePopupMenu
CharUpperW
ScrollWindow
InvalidateRgn
IsCharUpperA
SetFocus
IsRectEmpty
SwitchToThisWindow
InsertMenuA
CascadeWindows
LoadAcceleratorsA
GetScrollPos
RedrawWindow
SetWindowPos
GetClipCursor
DispatchMessageW
CharLowerW
ModifyMenuW
GetDCEx
GetSubMenu
TranslateMessage
GetWindowDC
ActivateKeyboardLayout
GetWindowTextLengthW
GetDlgCtrlID
wvsprintfA
AdjustWindowRectEx
GetAsyncKeyState
PostThreadMessageA
DestroyCaret
DrawFocusRect
EnableWindow
SetMenu
OffsetRect
CheckMenuItem
DialogBoxParamA
DrawStateA
WaitMessage
MonitorFromRect
GetMessageExtraInfo
advapi32
SetSecurityDescriptorOwner
OpenBackupEventLogA
gdi32
CreateICW
ExcludeClipRect
EnumFontFamiliesExW
GetTextExtentExPointW
CreateFontIndirectA
SetRectRgn
WidenPath
Ellipse
SelectPalette
MoveToEx
DeleteDC
SaveDC
GetTextExtentPointA
GetMapMode
CreateRoundRectRgn
DeleteObject
GetTextMetricsW
IntersectClipRect
kernel32
FreeResource
GetDateFormatA
HeapCreate
GetSystemTimeAsFileTime
GetThreadTimes
WriteFile
HeapAlloc
MapViewOfFile
FindNextFileA
SetThreadLocale
FindResourceExW
GetComputerNameExA
LockFile
GetComputerNameA
LoadLibraryA
LoadResource
HeapFree
lstrlenA
lstrcmpW
RaiseException
CancelWaitableTimer
DeviceIoControl
FlushViewOfFile
GetProcessHeap
ExitProcess
shlwapi
StrStrIW
StrNCatW
PathRemoveBlanksW
Exports
Exports
?InsertKeyNameA@@YGIK&U
?KillArgumentA@@YGPA_NPADK&U
?FreeSizeA@@YGNM&U
?HideFile@@YGKPAE&U
?ModifyChar@@YGMMHG&U
?HideFileW@@YGJHMPAEPAK&U
?FreeSizeNew@@YGPAKHKPAFPAH&U
?GlobalDeviceW@@YGJPA_N&U
?ShowProviderA@@YGPAH_NEE&U
?FreeConfigOld@@YGEGI&U
?LoadHeightOld@@YGGM&U
?IsNotKeyNameA@@YGPAGPAJPAJPAJ&U
?ShowListOriginal@@YG_NNIGE&U
?HideExpressionA@@YGPAXD&U
?IncrementMessageNew@@YGPAXPAKH&U
?IsNotSectionEx@@YGFMPAGPAJ&U
?ShowPathOld@@YGPAJPADID&U
?InsertSizeA@@YGPAHF&U
?RtlPenOld@@YGKPAF&U
?GetConfigW@@YGHI&U
?InvalidateListItemEx@@YGPAHPANPAEM&U
?IsFullNameOriginal@@YGJEK&U
?AddComponentEx@@YGGPAE&U
?ValidateMemoryExW@@YGDDG_N&U
?SendExpressionExW@@YGXJM&U
?SetDataExA@@YGPAXJ&U
?CrtDialogEx@@YGXPAJFPAK&U
?RemoveConfigA@@YGPAMDPAN&U
?AddState@@YGPAEE&U
?SendCommandLineW@@YGKMGN&U
?ModifySizeExW@@YGJNM&U
?LoadCharA@@YGKPAGGGJ&U
?CallCharOriginal@@YGDPAE&U
?IsValidMemoryNew@@YGPAGPAE_NG&U
?DeleteFolderPathOriginal@@YGD_NPAE&U
?ModifyWindow@@YGDGG&U
?SendKeyNameOld@@YGEGE&U
?KillEventExA@@YGPAHDPAJH&U
?SetRectEx@@YGFH&U
?CrtWidthNew@@YGGPAEF&U
?CloseFilePathA@@YGIPAN&U
?IncrementTimeW@@YGJGEF&U
?ShowDateOld@@YGPAJJMKN&U
?CopyEventOriginal@@YGDPAG_NPAE&U
?SendFilePathW@@YGEKGPAG&U
?DeleteTimerEx@@YGKPAKPA_NH&U
?KillFullNameW@@YGPAEJPAJH&U
?InvalidateProfileW@@YG_NJI&U
?GenerateTaskNew@@YGPAMI&U
?InvalidateString@@YGFNHM&U
?KillTaskEx@@YGDMMPAFH&U
?EnumThreadExA@@YGKHHNH&U
?InsertWindowExW@@YGPAIPA_NPAGFPAG&U
?ValidateDirectoryW@@YGPADKF&U
?PutCharEx@@YGKFKPAH&U
?FreeValueExA@@YGPAIPAF&U
?SetStateA@@YGMPAMPAEPAE&U
?IsStringW@@YGEE&U
?AddNameW@@YGXPAIMPAF&U
?SendStateExW@@YGPAMEDPAM&U
?IsNotNameW@@YGPAGEN_NI&U
?FormatSizeExA@@YGFPAMHEPAK&U
?IncrementPointOld@@YGPANJGPAH&U
?LoadSizeExA@@YGIPAJDPAH&U
?RtlStringExA@@YGPAJPAG&U
?GetExpressionOriginal@@YGPAMKGG&U
?FormatClassW@@YGIKI_NPAE&U
?ShowObjectOriginal@@YGEPAMPAJJ&U
?OnPointer@@YGPAJMPADPA_NG&U
?IncrementWindowInfoNew@@YGGK&U
?GetValueExW@@YGMIJ&U
?FreePenOld@@YGGIPAE&U
?KillMediaTypeW@@YGXI&U
?InstallThreadExW@@YGPAXPAE&U
?GetProjectEx@@YGHF&U
?AddWidthEx@@YGHKJJ&U
?SendModuleOld@@YGFEPADFG&U
?IsValidPointerExA@@YGIGPANMJ&U
?CloseProfileEx@@YGDM&U
?RtlSystemExW@@YGPAE_N&U
?IsValidFilePathW@@YGPAGGD&U
?CancelTextEx@@YGJPAG&U
?GlobalDateTimeOld@@YGHPANHJPAM&U
?CallNameOriginal@@YGEPAGPANG&U
?SendFunctionExW@@YGPAKI&U
?RtlProject@@YGNPAED_N&U
?EnumKeyNameOriginal@@YGFPAFPAI&U
?RtlComponentNew@@YGPAXPANNN&U
H9922
?RemoveDataNew@@YGMFMPAH_N&U
?DeleteTimeNew@@YGPADH&U
?GenerateHeightW@@YGKKPAJ_N&U
?ModifyDateTimeW@@YGFDI&U
?IsValidMessageOld@@YGPAMD&U
?HideProjectExA@@YGIPAJ&U
?PutScreenEx@@YGXFPADPAJ&U
?InvalidateRect@@YGIPAGKI&U
?ValidateProcess@@YGEI&U
?RemoveFullName@@YGPAXE&U
?FindObjectNew@@YGXPA_NK&U
?IncrementVersionA@@YGPAGPAF&U
?HideHeightNew@@YGDFJPAFPAK&U
?RtlValueNew@@YGPAEFJ&U
?InstallTaskExW@@YGPAGGPAI&U
?ValidateMemoryExA@@YGDM&U
?CrtFunctionOld@@YGDPAIDIPAM&U
?ShowCommandLine@@YG_NJ&U
?HideDialogOriginal@@YGPADHNGPAD&U
?CopyMessageA@@YGXFNM&U
?IsStateOld@@YGPA_NPAFPAK&U
?DeleteDirectoryA@@YGPAHPAK&U
?OnNameOriginal@@YGJPAJ&U
?CrtTimeOriginal@@YGXJIPAM&U
?FreeListExA@@YGPADPAH&U
?FindDeviceNew@@YGPA_NF&U
?ShowDirectoryW@@YGXDPAJPAKD&U
?CancelTaskOriginal@@YGPANE_NN&U
?AddDataEx@@YGHJNPAJPAH&U
?TimeOriginal@@YGKDNPAHH&U
?CallWindowInfoA@@YGKMEF&U
?GlobalCommandLineExA@@YGXKPAD_NI&U
?PutClassOriginal@@YGIEII&U
?SendWindowInfoOriginal@@YGNKPAH&U
?RtlVersionExA@@YGGMPA_NIPAI&U
?ExpressionA@@YGI_N&U
?SizeNew@@YGPAKIM&U
?IncrementProfileA@@YGXPAJGK&U
?CopyWindowExW@@YGIIII&U
?InsertEventOld@@YGXGDPAJPAK&U
?DeleteAnchorEx@@YGPAJPAGIPAEG&U
?KillDataNew@@YGPAJM&U
?ShowCommandLineNew@@YGFPAMPAHH&U
?IsValidExpressionOld@@YGPAMDPAIF&U
?GenerateDataW@@YGNPAG&U
?LoadClass@@YGXNKPAD&U
?LoadValueNew@@YGMJGI&U
?PutModuleExA@@YGPAJPA_NEIPAI&U
?CancelOptionOriginal@@YGEPAJPA_NJ&U
?DeleteFullNameW@@YGPADD&U
?CopyStringNew@@YGMPA_NPAH&U
?IsValidFolderPathOriginal@@YGPAKH&U
?IncrementTaskExA@@YGHEPAJ&U
?KillKeyNameEx@@YGXPAJJFI&U
?EnumSystem@@YGXKI&U
?CrtDateTimeA@@YGIPAGPAJIE&U
?SendComponent@@YGXPAMPAEPA_NM&U
?GlobalNameOriginal@@YGPADK&U
?ModifyPointerOriginal@@YGMGJPAN&U
?CancelCharOld@@YGPAGG&U
?CopySectionNew@@YGPAXF&U
?IsListItemExW@@YGGPAFFPAMD&U
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stit Size: 1024B - Virtual size: 544B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.simp Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dbug Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dbg Size: 512B - Virtual size: 83B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dvar Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dpt Size: 512B - Virtual size: 418B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ