mountvol.pdb
Behavioral task
behavioral1
Sample
287ac32706bd99e30bd0b18dc05de660_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
287ac32706bd99e30bd0b18dc05de660_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
287ac32706bd99e30bd0b18dc05de660_JaffaCakes118
-
Size
118KB
-
MD5
287ac32706bd99e30bd0b18dc05de660
-
SHA1
a4f07fd929626157e6f4490aa772f84deaf8e8b5
-
SHA256
7ff0341b7555125962853df0af5f178bb76616e98659dededce830269eb17e32
-
SHA512
a62721323da2d8d34bd893c3943a940b14f406d181c2111ad7d1acb8afb3bf1036d24bbc49dd61aa106058bb58399fd646138e9cd1e7fc87c9c70554389d3531
-
SSDEEP
3072:oN3T08GD7XKaCGBOVISe5I5FAQJDJNTv0aOdV+n8bduve0Eq:o3TQ7Rhie5uFpPNj0V/+iQYq
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 287ac32706bd99e30bd0b18dc05de660_JaffaCakes118
Files
-
287ac32706bd99e30bd0b18dc05de660_JaffaCakes118.exe windows:5 windows x86 arch:x86
9981cd6cf8ac71ab6e5fac16983bc03f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_XcptFilter
_exit
_c_exit
swprintf
wcscat
wcslen
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetModuleHandleA
SetErrorMode
GetStdHandle
GetConsoleMode
DeleteVolumeMountPointW
SetVolumeMountPointW
CreateFileW
DeviceIoControl
CloseHandle
SetLastError
GetVolumeNameForVolumeMountPointW
QueryPerformanceCounter
LoadLibraryExA
LocalFree
WriteFile
LocalAlloc
WriteConsoleW
FormatMessageW
GetLastError
GetVolumePathNamesForVolumeNameW
RemoveDirectoryW
QueryDosDeviceW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
DefineDosDeviceW
FindVolumeMountPointClose
FindNextVolumeMountPointW
FindFirstVolumeMountPointW
user32
CharToOemW
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE