NvOptimusEnablementCuda
Static task
static1
Behavioral task
behavioral1
Sample
66d53f6dc3280c10460fa457d2818ba1_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
66d53f6dc3280c10460fa457d2818ba1_JaffaCakes118
-
Size
2.2MB
-
MD5
66d53f6dc3280c10460fa457d2818ba1
-
SHA1
b76a7c4b9938303e4ec7845823194942a44b2c23
-
SHA256
b530f86a0c875be09843cf7b3c44afb176e127b31927a1631eedbffebcbd88d5
-
SHA512
5153e6711863ec4ba66f0d7c3d4309f8bf7392df64e957bc54013ba5ae2a527eee2bf1ed8ea85f470c04811d26052b4019335f4b8ace98abc239e7f615bc2f4e
-
SSDEEP
49152:YHQjwrPmoi4gg26Mf0uSfHEBiehoam8LG:HkjiZg26M8zvEBmamt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 66d53f6dc3280c10460fa457d2818ba1_JaffaCakes118
Files
-
66d53f6dc3280c10460fa457d2818ba1_JaffaCakes118.exe windows:6 windows x64 arch:x64
df32f221da4cb47e4312e43d0447927c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
connect
WSACleanup
__WSAFDIsSet
accept
send
ntohs
recv
WSAPoll
WSASetLastError
WSAStartup
select
WSARecvFrom
FreeAddrInfoW
GetAddrInfoW
bind
WSAIoctl
WSASend
shutdown
listen
WSASocketW
getsockname
socket
WSARecv
ioctlsocket
closesocket
getsockopt
setsockopt
htonl
WSAGetLastError
htons
gethostname
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
iphlpapi
GetAdaptersAddresses
kernel32
GetACP
SetFileAttributesW
GetFileAttributesExW
GetConsoleCP
SetStdHandle
ExitThread
GetModuleHandleExW
IsValidLocale
GetCommandLineW
GetCommandLineA
RtlPcToFileHeader
RtlUnwindEx
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
HeapSize
GetProcessHeap
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
GetFileInformationByHandle
GetThreadTimes
GetStdHandle
GetConsoleMode
SetConsoleMode
CloseHandle
FreeConsole
GetConsoleWindow
GetCurrentProcess
GetCurrentThread
GetSystemInfo
SetThreadAffinityMask
GetModuleHandleW
GetProcAddress
ExpandEnvironmentStringsA
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
SetWaitableTimer
CreateWaitableTimerW
SwitchToThread
TryEnterCriticalSection
TlsSetValue
EnterCriticalSection
ReleaseSemaphore
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
ResumeThread
GetLastError
SetEvent
TlsAlloc
ResetEvent
DeleteCriticalSection
CreateSemaphoreW
TlsGetValue
TlsFree
CreateSemaphoreA
CreateEventA
VerifyVersionInfoA
GetModuleFileNameW
MultiByteToWideChar
VerSetConditionMask
GetCurrentProcessId
WideCharToMultiByte
SetErrorMode
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
CreateFileW
DuplicateHandle
QueueUserWorkItem
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
ReadConsoleW
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
SetConsoleCursorPosition
SetConsoleCtrlHandler
Sleep
GetFileType
CreateDirectoryW
ReadFile
SetLastError
WriteFile
DeviceIoControl
RemoveDirectoryW
SetFileTime
CreateHardLinkW
GetFileAttributesW
SetFilePointerEx
MoveFileExW
CopyFileW
FlushFileBuffers
CancelIo
SetHandleInformation
LocalFree
FreeLibrary
FormatMessageA
LoadLibraryExW
GetModuleHandleA
LoadLibraryA
DebugBreak
SetNamedPipeHandleState
CreateNamedPipeW
PeekNamedPipe
GetNamedPipeHandleStateA
ConnectNamedPipe
GetLongPathNameW
ReadDirectoryChangesW
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
GetTickCount64
VirtualFree
VirtualAlloc
RaiseException
SetEnvironmentVariableA
GetModuleFileNameA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
FreeLibraryAndExitThread
HeapCreate
LocalAlloc
GetSystemDirectoryW
GetFullPathNameW
VerifyVersionInfoW
WaitForSingleObjectEx
CreateEventW
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
CreateThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DispatchMessageA
MapVirtualKeyW
GetMessageA
ShowWindow
TranslateMessage
Exports
Exports
Sections
.text Size: - Virtual size: 615KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 197KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nv_fatb Size: - Virtual size: 7.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nvFatBi Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 628B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ