c:\projects\onix\adobe_secure\Onix32\Release\Onix32.pdb
Static task
static1
General
-
Target
JaffaCakes118_b494b160988f95c85119ea973f54a9e0
-
Size
904KB
-
MD5
b494b160988f95c85119ea973f54a9e0
-
SHA1
0b93eccd0000a1c5841c953fbe2600a10bc7b3cd
-
SHA256
ffc83ceb68656785284b208d01533eac13607bf152f3ac49f28d12ca292c8ac7
-
SHA512
397a04352db620917d2a34a927038e1b1b610f8daa6d72fbbdbccaac9786926d9389eaa01c9a0b2ef3ccc6b9b5071f11b446e263b4ba6c4e5ee9c6a4e1fab7bd
-
SSDEEP
24576:0IZ9+e3LFRbk4vQL9TQVt5OntyUmP10wauIOmn1mmb18jfB/csw50jfBP:zQZ0Br41Lb1sTB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_b494b160988f95c85119ea973f54a9e0
Files
-
JaffaCakes118_b494b160988f95c85119ea973f54a9e0.dll windows:4 windows x86 arch:x86
d36487668bb90e2d87de4d447d17c08a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CreateMutexA
CloseHandle
RtlUnwind
HeapFree
HeapAlloc
GetLastError
DeleteFileA
MoveFileA
ExitProcess
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
GetCommandLineA
GetVersionExA
TlsFree
SetLastError
TlsGetValue
TlsAlloc
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
IsBadWritePtr
ReadFile
WriteFile
FlushFileBuffers
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetModuleFileNameA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
SetStdHandle
CreateFileA
LoadLibraryA
RaiseException
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
GetStringTypeA
GetStringTypeW
HeapSize
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
Exports
Exports
_ixAbortIndexingSession@8
_ixAddStopWord@16
_ixAddStopWordList@12
_ixAddWildCardPatternToHighlightMatcher@16
_ixAppendDistributedDataToIndex@12
_ixCharToHex@8
_ixCharWordToHexWord@12
_ixCloseIndex@8
_ixConvertQuery2@8
_ixConvertQuery@8
_ixCreateHighlightMatcher@4
_ixCreateIndex@16
_ixCreateIndexCreationParams@4
_ixCreateIndexEx@12
_ixCreateIndexManager@12
_ixCreateResultVector@4
_ixCreateRobotsTxtParser@4
_ixCreateStemmer@4
_ixCreateStopWordList@4
_ixCurrentKey@24
_ixDeleteHighlightMatcher@4
_ixDeleteIndexCreationParams@4
_ixDeleteIndexManager@8
_ixDeleteRecordNum@12
_ixDeleteRecordNums@16
_ixDeleteResultVector@8
_ixDeleteRobotsTxtParser@4
_ixDeleteStemmer@8
_ixDeleteStopWordList@4
_ixEndDistributedIndexingSession@16
_ixEndIndexingSession@20
_ixEndRetrievalSession@8
_ixFinalProcessIndex@20
_ixFindKey@28
_ixFindRecordID@16
_ixForceCloseOfAllFiles@4
_ixForceCloseOfTemporaryFiles@4
_ixGetCurrentQueryVector@12
_ixGetLibraryCompileDateAndTime@8
_ixGetLocationForTemporaryFiles@4
_ixGetMaximumWildcardTestLimit@4
_ixGetNumberOfRecordsDeleted@8
_ixGetNumberOfUnoptimizedInsertions@4
_ixGetStatusMessage@12
_ixGetTempDiskSpaceUsage@12
_ixHexToChar@8
_ixHighestRecordNumberInIndex@12
_ixHighlightMatcherMatch@12
_ixIncrementRecord@12
_ixIndexNumber@20
_ixIndexWord@12
_ixIndexWordSpecial@20
_ixIsRecordDeleted@12
_ixIsStopWord@16
_ixLongQueryFormToShortQueryForm@8
_ixMakeIndexActive@20
_ixNextKey@24
_ixNumHits@20
_ixNumStopWords@4
_ixNumberOfRecordsInIndex@12
_ixOpenIndex@12
_ixOpenIndexReadOnly@12
_ixOutputCompactRobotsTxt@8
_ixOutputDeletedRecords@12
_ixOutputStatsFile@12
_ixParseRobotsTxt@8
_ixPreviousKey@24
_ixProcessQuery@16
_ixProcessRecordID@24
_ixReloadIndex@8
_ixResetIndexCreationParams@4
_ixResetOpenFileTables@8
_ixRetrieveMoreRecordData@24
_ixRetrieveRecordData@28
_ixRetrieveRecordID@28
_ixRobotsPermissionGranted@8
_ixRobotsPermissionGrantedFullURL@8
_ixRobotsTxtLength@4
_ixSetBaseDistributedIndexDirectory@12
_ixSetFinalIndexDataFileNameAndPosition@16
_ixSetIndexCreationParams@12
_ixSetLocationForTemporaryFiles@4
_ixSetMaxRankedHits@12
_ixSetMaximumWildcardTestLimit@4
_ixSetNormalizedHits@12
_ixSetRobotName@12
_ixStartDistributedIndexingSession@8
_ixStartIndexingSession@8
_ixStartRetrievalSession@8
_ixStem8BitWord@28
_ixStemUnicodeWord@28
_ixStoreMoreRecordData@16
_ixStoreRecordData@16
_ixUnDeleteRecordNum@12
_ixUnDeleteRecordNums@16
_ixUnicodeCharToHex@8
_ixUnicodeHexToChar@8
_ixVectorAddHit@20
_ixVectorAnd@12
_ixVectorCurrentHit@24
_ixVectorNextHit@24
_ixVectorNextRecord@24
_ixVectorNot@12
_ixVectorOr@12
_ixVectorPreviousHit@24
_ixVectorPreviousRecord@24
_ixVectorRewind@8
_ucInitializeNormalizationTable@12
_ucNormalizeChar@8
_ucTableNormalizeChar@12
Sections
.text Size: 336KB - Virtual size: 334KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 428KB - Virtual size: 428KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE