d:\components\COMMON\Messenger\Release\ATLJabber.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4166f2ac9a976e8cf1e071a2d77a3674_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4166f2ac9a976e8cf1e071a2d77a3674_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
4166f2ac9a976e8cf1e071a2d77a3674_JaffaCakes118
-
Size
153KB
-
MD5
4166f2ac9a976e8cf1e071a2d77a3674
-
SHA1
79e091a51c29f552cbec2298e269740c557dcf8d
-
SHA256
eab5ad93d2b6504d4a6e10af6d800cdef80d255bba437157ab2934773e478b21
-
SHA512
5b7ee1fb1d13c00edf47c2ada8e10796ba4148ac0f4e0245c51ca50db36f6acea938d3792057bcaa99f5040e9312a9961974d53117372ce2a7576da7cdb2ef96
-
SSDEEP
3072:941DFniXy91ngRSAdwhm3we37bcm7pFmw6iGENdoI:+DiCo3z3fcpwVGENOI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4166f2ac9a976e8cf1e071a2d77a3674_JaffaCakes118
Files
-
4166f2ac9a976e8cf1e071a2d77a3674_JaffaCakes118.exe windows:4 windows x86 arch:x86
d9c59de5d42618caf45f42439def90f2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
shutdown
WSAGetLastError
send
recv
connect
htons
socket
gethostbyname
WSAStartup
closesocket
kernel32
GetStartupInfoA
GetModuleHandleA
CloseHandle
WaitForSingleObject
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrlenA
lstrcmpiA
lstrcpyA
lstrcatA
GetModuleFileNameA
Sleep
CreateThread
CreateEventA
lstrcpynA
QueryPerformanceCounter
IsDBCSLeadByte
InterlockedIncrement
SetEvent
InterlockedDecrement
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetCommandLineA
LeaveCriticalSection
EnterCriticalSection
TerminateThread
GetExitCodeThread
ExitProcess
LocalFree
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
user32
TranslateMessage
DispatchMessageA
GetMessageA
PostThreadMessageA
CharNextA
CharUpperA
KillTimer
SetTimer
advapi32
RegDeleteValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
ole32
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize
CoInitialize
oleaut32
SysStringLen
LoadRegTypeLi
VariantInit
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
VariantClear
shlwapi
PathFindExtensionA
msvcp70
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHABV12@@Z
?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIABV12@@Z
?_Nomemory@std@@YAXXZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
msvcr70
_purecall
realloc
__CxxFrameHandler
??_V@YAXPAX@Z
??3@YAXPAX@Z
__dllonexit
??1type_info@@UAE@XZ
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnwprintf
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__security_error_handler
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
memset
_callnewh
_amsg_exit
_CxxThrowException
_except_handler3
malloc
free
Sections
.text Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 612B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rrdata Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE