mcupdate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ffde4a7b4608e81405ce8a9a4b1df318_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ffde4a7b4608e81405ce8a9a4b1df318_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
ffde4a7b4608e81405ce8a9a4b1df318_JaffaCakes118
-
Size
230KB
-
MD5
ffde4a7b4608e81405ce8a9a4b1df318
-
SHA1
96205fcabd06b3b0d654c2ae488fe86103554dd3
-
SHA256
aa806524759e34fdd4884a64a1bd8700cc007f14355ccc4a0132444b13316ae0
-
SHA512
6c31f3ba942f5fe0542bdf64dacf1e11d7750aa75c08c750b6ea5a9aa459fb94c1f7697766687f6ed6bdd1c71388d1e5f299406263f963648b64a391e82aba9d
-
SSDEEP
6144:K+QPvsOvf7M7zszNdKizPcibieg7iJuIJ+ls:2vgWN1bi1i8C+ls
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ffde4a7b4608e81405ce8a9a4b1df318_JaffaCakes118
Files
-
ffde4a7b4608e81405ce8a9a4b1df318_JaffaCakes118.exe windows:6 windows x64 arch:x64
9b2f2fbeda89952aff99d37461e6fe92
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
msvcrt
memcpy
memset
__set_app_type
_fmode
_commode
__setusermatherr
_initterm
_wcmdln
exit
_exit
__C_specific_handler
__wgetmainargs
_callnewh
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
??1exception@@UEAA@XZ
?terminate@@YAXXZ
_amsg_exit
_cexit
wcsstr
malloc
free
??2@YAPEAX_K@Z
??1type_info@@UEAA@XZ
??3@YAXPEAX@Z
_errno
??0exception@@QEAA@AEBV0@@Z
_XcptFilter
?what@exception@@UEBAPEBDXZ
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
kernel32
CreateFileW
GetThreadLocale
LoadLibraryW
GetProcAddress
GetLastError
FreeLibrary
MultiByteToWideChar
GetVersionExW
VirtualProtect
VirtualAlloc
VirtualQuery
GetSystemInfo
GetCurrentThreadId
lstrlenW
Sleep
HeapSetInformation
RegisterApplicationRestart
RtlLookupFunctionEntry
SetLastError
GetVersion
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
lstrlenA
UnhandledExceptionFilter
RtlVirtualUnwind
SetUnhandledExceptionFilter
RtlCaptureContext
mscoree
_CorExeMain
CorBindToRuntimeEx
ole32
CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoUninitialize
oleaut32
SysStringLen
VariantClear
SysAllocString
SysFreeString
SysAllocStringLen
wintrust
WinVerifyTrust
crypt32
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertCreateCertificateContext
Sections
.text Size: 187KB - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nep Size: 1024B - Virtual size: 672B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 756B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 504B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ