D:\glyph\stable\build\client\GlyphCrashHandler64_r.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6e2dc34961b85e03c3b6ace5f6bb8fce_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6e2dc34961b85e03c3b6ace5f6bb8fce_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
6e2dc34961b85e03c3b6ace5f6bb8fce_JaffaCakes118
-
Size
1.8MB
-
MD5
6e2dc34961b85e03c3b6ace5f6bb8fce
-
SHA1
a9cd529b161eb8b8ac3c7e58bd2d9e5f6bb3692b
-
SHA256
d63099be3e789805bde852314a277ec82108b6912b1fc3a4bb475d5a9bf811a8
-
SHA512
966e3e0c6306d12679e65a78b8dcf4ff9058696324dfc314f18b5bb832dc37222f6851ad8156a76dbb6178beba82f38ea63b23bddfdadcd14766edc1effeed18
-
SSDEEP
24576:+GTTNxfuaxjMhwhFV5ZpxcbhpTozUHWxA5tz8+Pre1JJP:+ybj1htZpiExA5tz8+Pra
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e2dc34961b85e03c3b6ace5f6bb8fce_JaffaCakes118
Files
-
6e2dc34961b85e03c3b6ace5f6bb8fce_JaffaCakes118.exe windows:5 windows x64 arch:x64
cc3ccbc19db9a910592c7988cb612437
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
GetCurrentProcessId
GetCurrentThreadId
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
LocalFree
FormatMessageA
FormatMessageW
GetTempPathA
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileAttributesExW
GetFileInformationByHandle
GetTempFileNameW
WaitForSingleObjectEx
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetLocalTime
GetSystemInfo
GetSystemDirectoryW
GetComputerNameExW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CopyFileW
FileTimeToSystemTime
SystemTimeToFileTime
OpenProcess
VirtualQuery
OpenFileMappingW
FreeLibrary
LoadResource
LockResource
SizeofResource
LoadLibraryW
FindResourceW
ContinueDebugEvent
WaitForDebugEvent
DebugActiveProcess
DebugActiveProcessStop
SetEvent
WaitForSingleObject
CreateEventW
OpenEventW
OpenThread
SuspendThread
ResumeThread
GetThreadContext
GetModuleHandleW
DebugSetProcessKillOnExit
DebugBreakProcess
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
GlobalFree
GetCommandLineW
QueryPerformanceCounter
IsDebuggerPresent
GetCurrentProcess
GetModuleFileNameW
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
CreateMutexW
CreateThread
CreateProcessA
GetProcessId
GlobalMemoryStatusEx
GetWindowsDirectoryA
IsWow64Process
GetModuleFileNameA
CallNamedPipeW
GetTickCount64
HeapAlloc
HeapFree
GetProcessHeap
SetConsoleTextAttribute
GetOverlappedResult
SetFileTime
FindClose
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindFirstFileW
FindNextFileW
MoveFileW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
DecodePointer
EncodePointer
IsProcessorFeaturePresent
CloseHandle
GetLastError
GetTempPathW
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFileEx
LockFile
GetFullPathNameW
GetFullPathNameA
GetFileSize
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
FlushFileBuffers
DeleteFileW
DeleteFileA
CreateFileW
GetEnvironmentVariableW
CreateFileA
user32
RegisterClassExW
CreateWindowExW
DestroyWindow
PeekMessageW
DefWindowProcW
TranslateMessage
GetDesktopWindow
DispatchMessageW
advapi32
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptAcquireContextW
shell32
CommandLineToArgvW
ShellExecuteExW
ord165
SHGetFolderPathW
ole32
StringFromGUID2
CoTaskMemFree
CoCreateGuid
StringFromCLSID
dbghelp
MiniDumpWriteDump
psapi
GetModuleFileNameExW
GetProcessImageFileNameW
GetProcessMemoryInfo
iphlpapi
GetAdaptersInfo
winhttp
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReceiveResponse
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpWriteData
WinHttpQueryHeaders
WinHttpSetStatusCallback
WinHttpSetCredentials
msvcr120
isalnum
toupper
_strnicmp
strstr
wcsncmp
wcsstr
ceilf
_vswprintf_c_l
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__getmainargs
__set_app_type
exit
__CxxFrameHandler3
_cexit
_ismbblead
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_acmdln
_fmode
_commode
_vsnprintf
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crtSetUnhandledExceptionFilter
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
_wassert
fprintf
wcschr
iswspace
tolower
_strtoui64
_strtoi64
mbstowcs
_splitpath_s
strtoul
strtol
strtod
isspace
isalpha
_open_osfhandle
_chsize
_ftelli64
_fileno
_fdopen
_errno
_snprintf
_wsplitpath_s
_ui64tow
ftell
fseek
fread
fopen
strchr
memchr
__C_specific_handler
_itow_s
_wtoi
_unlock_file
_lock_file
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fputc
fgetpos
fgetc
fflush
fclose
memcpy_s
_beginthread
ldiv
wcsncpy
_wcslwr
_CxxThrowException
??1bad_cast@std@@UEAA@XZ
??0exception@std@@QEAA@AEBV01@@Z
??0bad_cast@std@@QEAA@AEBV01@@Z
??0bad_cast@std@@QEAA@PEBD@Z
_vsnprintf_s
??_U@YAPEAX_K@Z
??_V@YAXPEAX@Z
_vsnwprintf_s
_wfullpath
wcstombs_s
srand
rand
_wcslwr_s
_wcsicmp
wcsrchr
strncpy
iswalnum
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_purecall
strcmp
memset
memcpy
memcmp
_localtime64_s
strncmp
memmove
realloc
malloc
free
atoi
_exit
msvcp120
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
?_Getname@_Locinfo@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@HPEBD@Z
?_Xruntime_error@std@@YAXPEBD@Z
_FInf
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
_Mtx_destroy
_Mtx_init
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
??_7facet@locale@std@@6B@
??_7_Facet_base@std@@6B@
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??0facet@locale@std@@IEAA@_K@Z
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Strxfrm
_Strcoll
_Getcoll
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?id@?$codecvt@DDH@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Orphan_all@_Container_base12@std@@QEAAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Getcat@?$codecvt@DDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z
?out@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@
??_7ios_base@std@@6B@
?id@?$ctype@_W@std@@2V0locale@2@A
?_BADOFF@std@@3_JB
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setbase@std@@YA?AU?$_Smanip@H@1@H@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Winerror_map@std@@YAPEBDH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
??0_Container_base12@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
version
VerQueryValueW
GetFileVersionInfoW
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 17B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 736B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ