shmgrate.pdb
Behavioral task
behavioral1
Sample
25d646a88ac0e0f5a2805bb801fee3de_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
25d646a88ac0e0f5a2805bb801fee3de_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
25d646a88ac0e0f5a2805bb801fee3de_JaffaCakes118
-
Size
188KB
-
MD5
25d646a88ac0e0f5a2805bb801fee3de
-
SHA1
e795daad3420a22e6b2dd6a6179b9b64ecce314d
-
SHA256
2dd8d8b0ab22e71feb930d173cdff7e6b5db4075733ce9837c82dcded5313951
-
SHA512
64d07b4b11c1d758bb8c523995d2f65a23f79058627e8ab5fddd37a6d68551763556018e8b235b23215a2ff44997a9f2a695964bdd10106b45f64c7b60ae1b64
-
SSDEEP
3072:WyDeSSNIgF9ni5vdW7VKE1Q5fu8C/Oe3WbXy6Tn8dl4xWE1zjFNYq3LhL:WyaSSNIgF85pE1i2Vebn8QxWE1j
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25d646a88ac0e0f5a2805bb801fee3de_JaffaCakes118
Files
-
25d646a88ac0e0f5a2805bb801fee3de_JaffaCakes118.exe windows:5 windows x86 arch:x86
6065885756bba943e8280c2e981263aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
wcscat
wcslen
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsncmp
_c_exit
_exit
_XcptFilter
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
swscanf
advapi32
RegSetValueExW
RegFlushKey
RegDeleteKeyW
RegSetValueW
RegOpenKeyExA
SetFileSecurityW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegSetKeySecurity
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW
kernel32
LoadLibraryExA
GetVersionExW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetSystemDefaultUILanguage
LoadLibraryExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
lstrcmpA
MultiByteToWideChar
LocalFree
LocalAlloc
lstrcpyW
lstrcmpW
lstrcmpiW
GlobalFree
GetLastError
GlobalAlloc
SetFileAttributesW
GetFileAttributesW
lstrcpynW
lstrlenW
ExpandEnvironmentStringsW
CreateDirectoryW
GetModuleHandleW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
ExitProcess
lstrcpynA
lstrcmpiA
user32
LoadStringW
wsprintfW
GetMenuItemInfoW
GetMenuItemCount
CreatePopupMenu
DestroyMenu
userenv
ord127
ord120
ord128
shlwapi
PathFindExtensionW
ord158
StrStrIW
SHDeleteKeyW
SHCopyKeyW
ord433
PathRemoveExtensionW
PathRemoveBlanksW
PathCombineW
wnsprintfW
StrCmpIW
StrToIntW
SHSetValueW
SHGetValueW
PathAddExtensionW
PathAppendW
ord437
StrCatBuffW
SHDeleteValueW
shell32
SHParseDisplayName
SHBindToParent
ord155
SHGetSpecialFolderLocation
SHChangeNotify
SHGetMalloc
SHSetLocalizedName
SHGetSpecialFolderPathW
SHGetFolderPathW
ole32
CoInitialize
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize
Sections
.text Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE