D:\work\e0dd96435fde7cb0\BUILDS\Release\x64\SfxVps.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f33fc5789d82b1357be77b000e738380_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f33fc5789d82b1357be77b000e738380_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f33fc5789d82b1357be77b000e738380_JaffaCakes118
-
Size
1.2MB
-
MD5
f33fc5789d82b1357be77b000e738380
-
SHA1
738cad53ede38ca405100f96eb3fba5e14c71650
-
SHA256
936349e6adc6dda6e504244ac371381f6fe9722d42f7e40219b1cb61bc4e9249
-
SHA512
4799076ec806ed6bbc022d934a63009d099701b5f7aa2ca3a370f9a72c2298f75409fd5d56cc02b4d58ee3c02f7b8fd08e04fc0076592a44321d64c6af53997a
-
SSDEEP
24576:rMLnHxldM1+bj/L+0MJvFED+X/Te8sbQG2GUakTCa2aSJIUBTwE5bgnwJ4BW0J:rMLnHxldc+bjz+XG6THxP+Thbow2BW0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f33fc5789d82b1357be77b000e738380_JaffaCakes118
Files
-
f33fc5789d82b1357be77b000e738380_JaffaCakes118.exe windows:6 windows x64 arch:x64
4a9e3fab4880d74897bbfee40d5e7faf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntdll
RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlNtStatusToDosError
RtlVirtualUnwind
RtlUnwindEx
RtlUnwind
kernel32
GetExitCodeThread
GetConsoleMode
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
CloseHandle
FindClose
SetLastError
GetLastError
WideCharToMultiByte
FindFirstFileW
RemoveDirectoryW
DeviceIoControl
CreateFileW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
GetModuleHandleW
GetProcAddress
CreateProcessW
ResumeThread
GetCurrentThread
HeapAlloc
GetProcessHeap
GetSystemDirectoryW
lstrcatW
GetModuleHandleA
LocalFree
CreateEventW
GetExitCodeProcess
GetCurrentProcess
FindResourceW
SizeofResource
LockResource
LoadResource
GlobalAlloc
GlobalLock
GlobalFree
GlobalUnlock
SetEvent
CreateThread
TerminateThread
GetLocaleInfoW
FileTimeToSystemTime
GetCommandLineW
GetUserDefaultLangID
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
FormatMessageW
ReadFile
SetFilePointerEx
LoadLibraryExW
FreeLibrary
GetCurrentProcessId
TerminateProcess
Sleep
WaitForMultipleObjects
MultiByteToWideChar
CompareStringW
WriteFile
FlushFileBuffers
DeleteFileW
GetFileInformationByHandle
GetFullPathNameW
OutputDebugStringA
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
HeapFree
GetModuleHandleExW
LockFileEx
UnlockFileEx
GetFileSizeEx
SetEndOfFile
GetThreadId
InitializeCriticalSectionEx
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
TryEnterCriticalSection
GetSystemInfo
GetVersionExW
GetTickCount
QueryPerformanceCounter
ExpandEnvironmentStringsW
GetModuleFileNameW
GetShortPathNameW
GetFileAttributesW
GetWindowsDirectoryW
GetProcessAffinityMask
GetLongPathNameW
VirtualAlloc
VirtualFree
VirtualProtect
HeapDestroy
HeapReAlloc
GlobalMemoryStatusEx
ExitProcess
TlsFree
GetDriveTypeW
SetFilePointer
SetFileAttributesW
GetFileSize
MoveFileExW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
DuplicateHandle
SetFileTime
CreateDirectoryW
GetCurrentDirectoryW
FindFirstFileExW
FindNextFileW
QueryDosDeviceW
GetEnvironmentVariableW
SetEnvironmentVariableW
WriteProcessMemory
InitializeCriticalSectionAndSpinCount
LoadLibraryW
lstrcmpiA
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
GetVersion
HeapSize
FindResourceExW
RaiseException
DecodePointer
SetFileInformationByHandle
GetDiskFreeSpaceExW
K32GetMappedFileNameW
FindFirstVolumeW
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
VirtualQuery
GetSystemTimes
GetTickCount64
GetStdHandle
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
FreeLibraryAndExitThread
IsValidLocale
LCMapStringW
SetStdHandle
GetConsoleOutputCP
LoadLibraryExA
WaitForSingleObjectEx
GetStringTypeW
FormatMessageA
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
EncodePointer
LCMapStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
InterlockedPushEntrySList
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
ExitThread
ReadConsoleW
Exports
Exports
asw_process_storage_allocate_connector
asw_process_storage_deallocate_connector
on_avast_dll_unload
onexit_register_connector_avast_2
Sections
.text Size: 798KB - Virtual size: 798KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 239KB - Virtual size: 238KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 1024B - Virtual size: 728B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ