PrintFilterPipelineSvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0d52c740e447bf469cadde9d1a7835d8_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0d52c740e447bf469cadde9d1a7835d8_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0d52c740e447bf469cadde9d1a7835d8_JaffaCakes118
-
Size
660KB
-
MD5
0d52c740e447bf469cadde9d1a7835d8
-
SHA1
971c3f82ad0427e0e92cb208e12b7732f4e2f6bc
-
SHA256
10f7c0383bd31e7c7fa84a65624263e676e4528e9be35cac03d56dcff68157e2
-
SHA512
5bfcb523c60085eb45666ace9011258959cb6a5c48a13be323d3edd7448344116bc93a06db618505b0df6873e0084af1b958c9f0f169b636b31a2c6409f07b2e
-
SSDEEP
12288:arRAp8JenKw/CVE4KEJbqzX7oIp9GS4UoHkLZsoxth1U:yRRJEaVEtmbqzXj9i1iba
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d52c740e447bf469cadde9d1a7835d8_JaffaCakes118
Files
-
0d52c740e447bf469cadde9d1a7835d8_JaffaCakes118.exe windows:6 windows x86 arch:x86
3a7c642694b3852890c123f4c6718d28
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegQueryValueExW
RegEnumKeyExW
RegisterEventSourceW
SetThreadToken
OpenThreadToken
MapGenericMask
AccessCheck
ConvertStringSecurityDescriptorToSecurityDescriptorW
ReportEventW
kernel32
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
Sleep
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent
CreateThread
CreateEventW
GetModuleHandleW
GetCurrentThreadId
SetEvent
MultiByteToWideChar
SizeofResource
LoadResource
DeleteCriticalSection
GetModuleFileNameW
RtlCaptureStackBackTrace
HeapSetInformation
DeleteTimerQueueEx
RegisterWaitForSingleObject
InterlockedCompareExchange
UnregisterWaitEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
FormatMessageW
ReadFile
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
DebugBreak
SetFilePointerEx
CreateFileW
SetEndOfFile
LoadLibraryW
GetFileAttributesW
GetSystemDirectoryW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
CreateSemaphoreW
QueueUserWorkItem
ResetEvent
ReleaseSemaphore
LocalFree
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
WaitForSingleObject
CloseHandle
LoadLibraryExW
GetProcAddress
FreeLibrary
FindResourceW
GetVersionExA
InterlockedExchange
WideCharToMultiByte
GetStartupInfoW
HeapAlloc
HeapFree
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
SetUnhandledExceptionFilter
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
HeapSize
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
GetLocaleInfoW
CreateTimerQueue
user32
DispatchMessageW
TranslateMessage
GetMessageW
PostThreadMessageW
LoadStringW
CharNextW
UnregisterClassA
oleaut32
SysAllocStringLen
GetErrorInfo
VariantCopy
VariantClear
VariantInit
SysAllocString
SetErrorInfo
SysFreeString
VarUI4FromStr
ole32
CoGetObjectContext
StringFromGUID2
CoCreateGuid
CoRevertToSelf
CreateStreamOnHGlobal
IIDFromString
CoResumeClassObjects
CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoUninitialize
CoSuspendClassObjects
CoTaskMemAlloc
CoTaskMemRealloc
CoRevokeClassObject
CoImpersonateClient
CoRegisterClassObject
ntdll
RtlUnwind
xpssvcs
DDLogHelper
CreateReachPackageReceiver
CreateReachPackageSender
psapi
EnumProcessModules
GetModuleFileNameExW
GetModuleInformation
winspool.drv
WritePrinter
SeekPrinter
ReadPrinter
StartPagePrinter
EndPagePrinter
ClosePrinter
SetJobW
DocumentPropertiesW
EndDocPrinter
StartDocPrinterW
GetPrinterDriverDirectoryW
OpenPrinterW
GetPrinterDataW
prntvpt
ord9
ord4
ord2
Sections
.text Size: 594KB - Virtual size: 594KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 50KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE