Troneton.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
6c757d678105b9c79e56aeae552871b2_JaffaCakes118
-
Size
120KB
-
MD5
6c757d678105b9c79e56aeae552871b2
-
SHA1
53e9563337201cef300c192de8fc9c20688e6d69
-
SHA256
392b1e9b1d943bf15c0668b0494fdb1a23eb57f44e0afae26ebcf9ed356528e4
-
SHA512
30711d53941c43ab17f51eec1171542013899382b53e4e5c32e81cd46925be35fc4eae58fa1e41ff27db1fe3c6a0289332a58cb6b9738e655ac2cdb0dd4c85c6
-
SSDEEP
1536:hh+VKbz74iVTtbnEQhhSqklN4oyk2tO+ELlDStvvztFTzmcK:hhTHMi/EQORlyk28J2dvZN5K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 6c757d678105b9c79e56aeae552871b2_JaffaCakes118
Files
-
6c757d678105b9c79e56aeae552871b2_JaffaCakes118.exe windows:6 windows x86 arch:x86
65da2bc76814befce597c7e371362f88
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
winscard
SCardReleaseContext
rpcrt4
RpcServerUseProtseqEpA
setupapi
CM_Get_DevNode_Registry_Property_ExW
SetupSetDirectoryIdExW
CM_Get_Device_Interface_ListW
SetupDiOpenDeviceInterfaceW
msvcrt
printf
fgets
shlwapi
SHRegDuplicateHKey
PathUnExpandEnvStringsA
mprapi
MprAdminInterfaceCreate
oleaut32
VarI4FromStr
SafeArrayRedim
BstrFromVector
ole32
OleSetClipboard
StgCreatePropStg
CoGetCurrentProcess
HWND_UserUnmarshal
crypt32
CertDeleteCTLFromStore
CertGetSubjectCertificateFromStore
advapi32
AreAllAccessesGranted
GetSidLengthRequired
MakeAbsoluteSD
OpenSCManagerA
CryptEnumProvidersW
ReadEventLogA
IsValidAcl
user32
SwitchDesktop
EnumThreadWindows
SetRect
SetWindowContextHelpId
UnhookWindowsHook
ShowWindowAsync
DefWindowProcW
GetDesktopWindow
GetClipCursor
IsClipboardFormatAvailable
InvalidateRgn
GetProcessWindowStation
SetClassLongW
GetWindowContextHelpId
kernel32
SetStdHandle
ExpandEnvironmentStringsA
CreateMutexExA
BindIoCompletionCallback
GetSystemWindowsDirectoryW
SignalObjectAndWait
SetNamedPipeHandleState
SetConsoleCursorInfo
CloseHandle
DeleteTimerQueueTimer
DisconnectNamedPipe
GetCurrentConsoleFont
GetUserPreferredUILanguages
GetStdHandle
GetLocalTime
GetUserDefaultUILanguage
GetConsoleDisplayMode
GetDynamicTimeZoneInformation
SetHandleCount
GetCommandLineW
GetCPInfo
OpenJobObjectW
wintrust
CryptCATAdminAcquireContext
CryptCATCDFOpen
gdi32
OffsetRgn
SetViewportExtEx
CombineRgn
CreateDCW
winmm
waveInClose
DefDriverProc
midiInUnprepareHeader
rasapi32
RasDeleteEntryW
Sections
.text Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt1 Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ