g:\svn\MC-60\Components\deployment\ZFTradingSystem.pdb
Static task
static1
Behavioral task
behavioral1
Sample
119f44d782a90f6be063e35d9329fc9e_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
119f44d782a90f6be063e35d9329fc9e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
119f44d782a90f6be063e35d9329fc9e_JaffaCakes118
-
Size
732KB
-
MD5
119f44d782a90f6be063e35d9329fc9e
-
SHA1
5232ab1d31b96051acbe3d13ad6fd979677768e7
-
SHA256
ff5d85c67562a9a623cffbc37f0756186f93c654593362101ac0608799ab003d
-
SHA512
def5e66f53a3d58da65e780572ca36a70a43cdcfbdf5a79151551bf5d2db5e6585b4bba56f3ba6102ae607dfd4c84bed178983eab34459ae6b051cc3645ebcc0
-
SSDEEP
12288:YJJmFh/k4ZL98fQIHL0om7YLlOWwfJL93JL1/hLILWFL2LrLwLVLXLWzNwKW1oCl:YJGKQglOWwfJL93JL1/hLILWFL2LrLwR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 119f44d782a90f6be063e35d9329fc9e_JaffaCakes118
Files
-
119f44d782a90f6be063e35d9329fc9e_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
085a50d9ce5eb77ba08134fef1d97dbd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
advapi32
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryValueExA
RegQueryValueExW
RegDeleteValueW
RegQueryInfoKeyW
psapi
EnumProcessModules
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
comctl32
ord17
kernel32
FindResourceW
FindResourceExW
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
GetModuleHandleW
GetModuleFileNameW
MulDiv
HeapFree
GetProcessHeap
SetLastError
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryW
LoadLibraryA
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
LoadResource
GetProcAddress
FreeLibrary
GetThreadContext
GetCurrentThread
SetUnhandledExceptionFilter
IsBadReadPtr
MultiByteToWideChar
LoadLibraryExW
SetThreadLocale
GetThreadLocale
FindClose
FindFirstFileW
GetTickCount
FlushInstructionCache
lstrcpyW
Sleep
InterlockedCompareExchange
VirtualFree
IsProcessorFeaturePresent
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
GetVersionExA
GetLocaleInfoA
GetACP
InterlockedExchange
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
VirtualAlloc
lstrlenA
WideCharToMultiByte
UnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcessId
GetSystemTimeAsFileTime
LocalAlloc
DebugBreak
user32
RedrawWindow
InvalidateRect
GetClientRect
WinHelpW
UnregisterClassA
MessageBoxW
IsWindowVisible
EnableWindow
SetFocus
SetDlgItemTextW
GetParent
GetDlgItem
DefWindowProcW
GetWindowTextW
GetWindowTextLengthW
CallWindowProcW
GetWindowLongW
SendMessageW
CreateDialogParamW
SetWindowTextW
PostMessageW
IsWindowEnabled
PostQuitMessage
PeekMessageW
TranslateMessage
DispatchMessageW
KillTimer
SetTimer
GetFocus
RegisterClassExW
CreateWindowExW
LoadCursorW
GetClassInfoExW
GetDlgCtrlID
OffsetRect
InflateRect
DrawFocusRect
CopyRect
GetSysColor
GetSystemMetrics
IsWindow
GetDC
ReleaseDC
GetDialogBaseUnits
SetWindowLongW
DestroyWindow
IsDialogMessageW
MoveWindow
ShowWindow
CharNextW
FillRect
gdi32
CreateFontIndirectW
GetTextMetricsW
DeleteDC
CreateSolidBrush
SetBkMode
GetDeviceCaps
SelectObject
GetTextExtentPointW
SetTextColor
GetObjectW
GetCurrentObject
SetROP2
ExtTextOutW
CreatePen
GetTextExtentPoint32W
DeleteObject
shell32
SHGetPathFromIDListW
SHGetMalloc
SHCreateDirectoryExW
SHGetFolderPathW
SHGetFileInfoW
SHBrowseForFolderW
ole32
CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
CLSIDFromString
CoTaskMemAlloc
StringFromCLSID
oleaut32
SysAllocStringByteLen
SafeArrayPutElement
SafeArrayGetElement
SafeArrayRedim
GetRecordInfoFromGuids
VariantCopy
RegisterTypeLi
UnRegisterTypeLi
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnlock
SafeArrayLock
SafeArrayGetDim
VariantClear
VariantChangeType
VariantInit
SysStringByteLen
SysAllocString
SysAllocStringLen
SafeArrayGetVartype
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysFreeString
SafeArrayDestroy
msvcp80
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?width@ios_base@std@@QAEHH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?eof@?$char_traits@D@std@@SAHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@III_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??0?$allocator@_W@std@@QAE@XZ
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?max_size@?$allocator@_W@std@@QBEIXZ
??0?$allocator@_W@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBEHXZ
?length@?$char_traits@D@std@@SAIPBD@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
msvcr80
??_V@YAXPAX@Z
wcsncpy_s
__CxxFrameHandler3
memmove_s
??2@YAPAXI@Z
wcscpy_s
_purecall
_recalloc
memset
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_wassert
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_snwprintf
calloc
_vsnprintf_s
_vsnwprintf_s
_wsplitpath
wcscat_s
swprintf_s
_itow_s
_vscwprintf
vswprintf_s
_wtoi
wcsstr
srand
_ltow
?terminate@@YAXXZ
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
memcpy_s
malloc
free
??3@YAXPAX@Z
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 436KB - Virtual size: 434KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 176KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ