e:\MoloCollection\MoloSoft\dev\QQAppExternal2\Running\release_dyn\AndroidPopup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_018656ec50bb591bb524dee10cbb02d0.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_018656ec50bb591bb524dee10cbb02d0.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_018656ec50bb591bb524dee10cbb02d0
-
Size
483KB
-
MD5
018656ec50bb591bb524dee10cbb02d0
-
SHA1
e3ad0c124aaffc821342a9dd5cadf940ddfd1d54
-
SHA256
55b045ba63694d5c670185b06a77ad37fcefa68edf453c3b77a7366d839c3a61
-
SHA512
abfa4b19d740990192d625f1a441d97b7f88eb6bf6179e3493535d36ee14ef5149c526bfffeb296f6e09e1faa41469619321a1156d2bff872821bf977f15db19
-
SSDEEP
12288:V8NvWysEdyGnrVde3iOHB57gonaFgzpgiwSDKDXXkGjm:euqdVe3JHB5EoaFgz2oIXNi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_018656ec50bb591bb524dee10cbb02d0
Files
-
JaffaCakes118_018656ec50bb591bb524dee10cbb02d0.exe windows:4 windows x86 arch:x86
0ea936fd881f53ea4511de5e42010c1e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
psapi
EnumProcesses
GetModuleFileNameExW
cfgmgr32
CM_Get_Sibling
CM_Get_Device_IDW
CM_Get_Child
CM_Locate_DevNodeW
setupapi
SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
rpcrt4
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrCStdStubBuffer2_Release
RpcStringFreeA
UuidToStringA
UuidCreateSequential
NdrStubCall2
NdrStubForwardingFunction
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
wininet
InternetCrackUrlW
InternetCanonicalizeUrlW
InternetCloseHandle
InternetReadFile
HttpQueryInfoW
InternetOpenUrlW
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW
kernel32
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FlushInstructionCache
GetCurrentProcess
SetLastError
Sleep
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
CreateDirectoryW
CloseHandle
WaitForSingleObject
CreateThread
CreateEventW
GetModuleHandleW
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
SetEvent
GetCommandLineW
lstrlenW
GetModuleFileNameW
GetLastError
DeviceIoControl
CreateFileW
GetVolumeInformationW
CreateMutexW
GetPrivateProfileStringW
CreateProcessW
OpenProcess
GetProcAddress
TerminateThread
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
RaiseException
ReadFile
WriteFile
GetFileSize
GetTempFileNameW
GetTempPathW
DeleteFileW
GetExitCodeProcess
GetExitCodeThread
GetTickCount
ResetEvent
WaitForMultipleObjects
ResumeThread
TerminateProcess
WriteProcessMemory
SetUnhandledExceptionFilter
GlobalUnlock
GlobalLock
lstrcpyW
CreateTimerQueueTimer
DeleteTimerQueueTimer
GlobalFree
GlobalAlloc
FreeLibrary
GetStringTypeExW
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
user32
GetWindowLongW
PostQuitMessage
DefWindowProcW
PostMessageW
CharUpperW
CharNextW
PostThreadMessageW
DispatchMessageW
GetDesktopWindow
TranslateMessage
CallWindowProcW
RegisterClassExW
CreateWindowExW
DestroyWindow
LoadCursorW
GetClassInfoExW
ShowWindow
UpdateWindow
SetWindowPos
SetWindowLongW
UnregisterClassA
LoadStringW
GetMessageW
DestroyIcon
UpdateLayeredWindow
PtInRect
ReleaseCapture
GetCapture
SystemParametersInfoW
AdjustWindowRectEx
GetDlgCtrlID
GetParent
SetCapture
KillTimer
SetTimer
GetMenu
EndPaint
BeginPaint
LoadMenuW
GetSubMenu
CheckMenuRadioItem
TrackPopupMenu
TrackMouseEvent
SetFocus
IsWindowEnabled
InvalidateRect
ScreenToClient
ClientToScreen
IsWindow
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
MsgWaitForMultipleObjects
SendMessageW
SendMessageTimeoutW
GetClientRect
gdi32
DeleteDC
EnumFontFamiliesExW
DeleteObject
CreateCompatibleDC
SelectObject
SetViewportOrgEx
CreateCompatibleBitmap
BitBlt
CreateDCW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitializeEx
CreateStreamOnHGlobal
CLSIDFromString
oleaut32
VariantChangeType
SysAllocStringByteLen
VarUdateFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayCopy
SafeArrayDestroy
SafeArrayCreate
SysAllocString
SafeArrayLock
SafeArrayUnlock
SafeArrayGetUBound
VariantClear
SafeArrayGetLBound
VariantInit
SafeArrayGetVartype
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysFreeString
atl80
ord20
ord18
ord22
ord43
ord44
ord64
ord23
ord61
ord31
ord58
ord32
ord17
shlwapi
PathFindFileNameW
PathRemoveFileSpecW
PathAppendW
UrlUnescapeW
PathCanonicalizeW
PathAddExtensionW
PathRemoveExtensionW
PathFileExistsW
comctl32
ImageList_GetIconSize
_TrackMouseEvent
ImageList_Destroy
gdiplus
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipCreateFromHDC
GdipSetCompositingQuality
GdipSetTextRenderingHint
GdipDeleteStringFormat
GdipCreateStringFormat
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipGraphicsClear
GdipFree
GdipDeleteBrush
GdipSetStringFormatFlags
GdipCreateSolidFill
GdipGetImageHeight
GdipGetImageWidth
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipDeleteRegion
GdipFillRegion
GdipDrawString
GdipDrawImageRectRectI
GdipCreateRegionRectI
GdipCloneBrush
GdiplusStartup
GdiplusShutdown
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipDisposeImage
GdipSetImageAttributesWrapMode
GdipCloneImage
GdipDeleteGraphics
GdipAlloc
msvcp80
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W0@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?_Tidy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEX_NI@Z
??$?O_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V32@_W@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Xran@_String_base@std@@SAXXZ
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
msvcr80
strncmp
isalnum
isalpha
tolower
isspace
fclose
_vsnprintf_s
_CxxThrowException
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??3@YAXPAX@Z
strchr
_itoa
fopen
_mktime64
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_initterm_e
fprintf
fseek
ftell
fread
fopen_s
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
memmove
_beginthreadex
__p__fmode
strcpy_s
memcpy
strcmp
atoi
wcsrchr
wcschr
wcstol
wcspbrk
iswspace
__RTDynamicCast
_wtoi
strlen
wcsftime
_time64
calloc
_localtime64_s
_wtol
vswprintf_s
_vscwprintf
_wcslwr_s
_wcsicmp
??_V@YAXPAX@Z
wcscpy_s
malloc
wcsncpy
_waccess
free
wcsstr
_wcsupr_s
wcscspn
wcsspn
memcmp
_recalloc
memcpy_s
wcslen
wcscmp
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
memset
??2@YAPAXI@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
memmove_s
_wcmdln
??8type_info@@QBE_NABV0@@Z
swprintf_s
ws2_32
closesocket
ioctlsocket
socket
send
recv
setsockopt
select
inet_addr
htons
connect
Sections
.text Size: 276KB - Virtual size: 273KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.orpc Size: 4KB - Virtual size: 45B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE