w32tm.pdb
Static task
static1
Behavioral task
behavioral1
Sample
010b52f673a5b75855cc9ff41dc992e5_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
010b52f673a5b75855cc9ff41dc992e5_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
010b52f673a5b75855cc9ff41dc992e5_JaffaCakes118
-
Size
196KB
-
MD5
010b52f673a5b75855cc9ff41dc992e5
-
SHA1
19699e3ff9caf3a3f3886e9fa4eb486c8be9b528
-
SHA256
9a41aae8074524007d4d8ac917285a96db6fab3658a8a05207b52483fc68aefc
-
SHA512
317f35cbda57b3cb2bc890029d8e16b8da82a15f3b15ac14f0d279a7467df872f3187d04ec4914d6a22bb9aab65ddb703bcdbc9e4d7a81e8583d9b7a44cc71c4
-
SSDEEP
3072:RcwSawBcdkkRFr9kobtOGF8dPpbWPaIPdUN2A7JJCIcyZFv362lWbbdAP8DPvUrS:MDi2krfOlC+CgYbhAP8LQCZ3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 010b52f673a5b75855cc9ff41dc992e5_JaffaCakes118
Files
-
010b52f673a5b75855cc9ff41dc992e5_JaffaCakes118.exe windows:5 windows x86 arch:x86
ada124ce7ac9e04f58e211c5a6e5fdb3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
wprintf
iswalpha
iswdigit
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
wcschr
__setusermatherr
iswspace
wcslen
_vsnwprintf
??1exception@@UAE@XZ
??3@YAXPAX@Z
__CxxFrameHandler
wcstoul
_ftol
wcscpy
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_ltow
wcscat
_snwprintf
?what@exception@@UBEPBDXZ
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_CxxThrowException
_initterm
_except_handler3
??1type_info@@UAE@XZ
_controlfp
_wcsicmp
msvcp60
??1bad_alloc@std@@UAE@XZ
advapi32
StartServiceCtrlDispatcherW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegConnectRegistryW
RegOpenKeyW
RegSetValueExW
OpenSCManagerW
OpenServiceW
ControlService
RegCloseKey
CloseServiceHandle
SetServiceStatus
RegisterServiceCtrlHandlerExW
RegQueryValueExW
kernel32
QueryPerformanceCounter
GetCommandLineW
ExpandEnvironmentStringsW
CreateEventW
GetModuleHandleW
CreateThread
WaitForSingleObject
InterlockedIncrement
MultiByteToWideChar
LoadLibraryW
GetProcAddress
FormatMessageW
GetTickCount
Sleep
OpenEventW
SetEvent
CloseHandle
GetStdHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLastError
GetDateFormatW
LocalAlloc
GetTimeFormatW
LocalFree
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
GetStartupInfoA
GetFileType
WriteFile
WideCharToMultiByte
WriteConsoleW
GetTimeZoneInformation
FreeLibrary
ntdll
NtQuerySystemTime
user32
LoadStringW
DialogBoxParamW
EndDialog
GetDlgItem
EnableWindow
SendDlgItemMessageW
wsprintfW
CharUpperW
ws2_32
send
closesocket
recv
WSAEventSelect
WSACleanup
WSAStartup
WSALookupServiceBeginW
WSALookupServiceNextW
WSAGetLastError
WSALookupServiceEnd
socket
connect
gethostbyaddr
netapi32
DsGetDcNameW
NetServerEnum
NetApiBufferFree
w32time
W32TimeQueryNTPProviderStatus
W32TimeGetNetlogonServiceBits
W32TimeSyncNow
icmp
IcmpCreateFile
IcmpSendEcho
IcmpCloseHandle
ntdsapi
DsFreeDomainControllerInfoW
DsUnBindW
DsGetDomainControllerInfoW
DsBindW
shell32
CommandLineToArgvW
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PACK Size: 144KB - Virtual size: 380KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE