wuauclt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
152f7496026001c112aa513ae79433a7_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
152f7496026001c112aa513ae79433a7_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
152f7496026001c112aa513ae79433a7_JaffaCakes118
-
Size
190KB
-
MD5
152f7496026001c112aa513ae79433a7
-
SHA1
d2dbe97cab52191461c742acbddd0cd1d3966d7b
-
SHA256
0a3414e1557b1b84852e4595652cb42b8b6f48cb36793cab49c3658d0394cf9b
-
SHA512
64515a8902531ac2cfc0c380c2388f317c70c244fa68adf9059467857a5fc05743fb4195961a87c19fa6f8f39d0936a47e5ac03d8aefbf3b4171d9acbbb70e19
-
SSDEEP
3072:COqyBokcdaHSuBFKCLtNgEBf+xwzEqJ+5+tOAZgwC03fOwYSS4qeO8hk8jb7QS:COqoxcduSuBFTsEh+KBJ+7AvPBBS4j/I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 152f7496026001c112aa513ae79433a7_JaffaCakes118
Files
-
152f7496026001c112aa513ae79433a7_JaffaCakes118.exe windows:6 windows x86 arch:x86
20cc7adf5ee7770f065f3d5b04e6414f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateFileW
CreateDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
lstrlenW
CreateProcessW
VerSetConditionMask
VerifyVersionInfoW
OutputDebugStringW
WideCharToMultiByte
WriteFile
FlushFileBuffers
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
GetSystemTime
GetLastError
SetLastError
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetFilePointer
SetEndOfFile
ReleaseMutex
WaitForSingleObject
CreateMutexW
CloseHandle
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
InterlockedExchange
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetSystemDirectoryW
LoadLibraryExW
GetDriveTypeW
GetVolumePathNameW
GetFileType
GetSystemInfo
GetModuleHandleW
CompareStringW
GetProcessHeap
HeapFree
HeapAlloc
GetCommandLineW
FreeLibrary
LoadLibraryW
InterlockedCompareExchange
OpenEventW
GetProcAddress
msvcrt
_controlfp
?terminate@@YAXXZ
free
malloc
memmove
memcpy
memset
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_unlock
_vsnwprintf
__dllonexit
_lock
_onexit
__wgetmainargs
_cexit
ntdll
RtlUnwind
ole32
CoTaskMemFree
CoUninitialize
CoCreateInstance
CoInitialize
CoInitializeEx
advapi32
AllocateAndInitializeSid
FreeSid
GetTokenInformation
DuplicateTokenEx
CheckTokenMembership
IsValidSid
CopySid
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
RegDeleteValueW
GetUserNameW
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExW
RegCloseKey
user32
IsWindow
PostMessageW
oleaut32
VariantClear
VariantInit
shlwapi
StrRChrW
StrChrW
ord176
PathIsRelativeW
PathIsUNCW
PathStripToRootW
PathIsRootW
Sections
.text Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PACK Size: 144KB - Virtual size: 380KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE