svchost.pdb
Static task
static1
General
-
Target
eb9d7cf975c5885a538324f10f5b8ba8_JaffaCakes118
-
Size
432KB
-
MD5
eb9d7cf975c5885a538324f10f5b8ba8
-
SHA1
165f8cac988e48bba83728e3b4ea05b57515c707
-
SHA256
a2c5fe4182d4ca40cc701ede58913aee81eca5f5f966f8e93455bdf9fe5ef183
-
SHA512
c689ee698d6dfd97ba62787092f09ef394b0e75bd54115e3f922a5ba68e86c3ce7a61b3c7c8d768e905dd3b758cf1fe829b3d368dcf654906bd612ea40a34eb9
-
SSDEEP
6144:2FUCmZqoFWC6xKbKQeSPTJruoC0mf8STTrpahBkEgQZ875Ql1+h38iJ/i8C:GUCmZiCvbHPT438qlA3Ba7el1eVd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource eb9d7cf975c5885a538324f10f5b8ba8_JaffaCakes118
Files
-
eb9d7cf975c5885a538324f10f5b8ba8_JaffaCakes118.exe windows:10 windows x86 arch:x86
41721e0f933696d50ab32d544d64dcd3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
api-ms-win-core-crt-l2-1-0
_initterm
_initterm_e
__wgetmainargs
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
SetProcessAffinityUpdateMode
ExitProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
SetErrorMode
UnhandledExceptionFilter
api-ms-win-service-private-l1-1-3
I_RegisterSvchostNotificationCallback
api-ms-win-core-crt-l1-1-0
qsort_s
memset
memcpy
_wcsicmp
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetProcAddress
LoadLibraryExW
api-ms-win-core-heap-l1-1-0
HeapSetInformation
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeSRWLock
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockShared
api-ms-win-service-winsvc-l1-1-0
RegisterServiceCtrlHandlerW
api-ms-win-service-core-l1-1-0
StartServiceCtrlDispatcherW
SetServiceStatus
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegDisablePredefinedCacheEx
RegQueryValueExW
RegGetValueW
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
ExpandEnvironmentStringsW
api-ms-win-core-processthreads-l1-1-1
SetProcessMitigationPolicy
api-ms-win-core-processthreads-l1-1-2
SetProtectedPolicy
rpcrt4
RpcServerUnregisterIfEx
I_RpcMapWin32Status
RpcServerUseProtseqEpW
RpcMgmtSetServerStackSize
RpcServerUnregisterIf
RpcServerRegisterIf
RpcMgmtStopServerListening
RpcServerListen
RpcMgmtWaitServerListen
I_RpcServerDisableExceptionFilter
api-ms-win-core-localization-l1-2-0
LCMapStringW
api-ms-win-security-base-l1-1-0
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
GetLengthSid
AddAccessAllowedAce
InitializeAcl
GetTokenInformation
InitializeSecurityDescriptor
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
api-ms-win-crt-utility-l1-1-0
bsearch_s
api-ms-win-core-sidebyside-l1-1-0
ReleaseActCtx
CreateActCtxW
DeactivateActCtx
ActivateActCtx
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
ntdll
RtlQueryHeapInformation
RtlImageNtHeader
_vsnwprintf
TpSetTimer
TpReleaseTimer
TpWaitForTimer
TpSetTimerEx
EtwEventWrite
RtlRunOnceExecuteOnce
RtlNtStatusToDosError
EtwEventEnabled
TpReleaseWait
RtlNtStatusToDosErrorNoTeb
TpSetWait
TpAllocWait
EtwEventRegister
RtlUnhandledExceptionFilter
NtSetInformationProcess
RtlSetProcessIsCritical
RtlInitializeCriticalSection
RtlInitializeSid
RtlAllocateHeap
RtlSubAuthoritySid
RtlGetDeviceFamilyInfoEnum
RtlReleaseSRWLockExclusive
RtlSubAuthorityCountSid
RtlAcquireSRWLockExclusive
RtlLengthRequiredSid
RtlDeriveCapabilitySidsFromName
RtlCopySid
RtlFreeHeap
TpAllocTimer
NtQuerySystemInformation
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 400KB - Virtual size: 992KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ