s:\NeroHome100x\NeroMediaManager\MediaLibrary\src\NMIndexStoreSvr\Release Unicode\NMIndexStoreSvr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2e8c3ec792dd4166a26bd06f0717c43a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2e8c3ec792dd4166a26bd06f0717c43a_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2e8c3ec792dd4166a26bd06f0717c43a_JaffaCakes118
-
Size
532KB
-
MD5
2e8c3ec792dd4166a26bd06f0717c43a
-
SHA1
ee56e3d6ad71a22f77f3022cc45ccfd307411ebb
-
SHA256
88812affb4d498718a32cd8eb5b1b980badaa5cd53db735ad9dd2994081d519e
-
SHA512
29603a98b60cbd5c057cad1c371190d895e1b80bdf68b55503f571df77ec5d4caecb01f5b727a841ce3a8c821fcd34ca388c6db1bd159956763ce007dc91808b
-
SSDEEP
12288:rasfbB8sYo2V8KARMYTLBtyDNzeqAWolpg:rh9LMqTyMxO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e8c3ec792dd4166a26bd06f0717c43a_JaffaCakes118
Files
-
2e8c3ec792dd4166a26bd06f0717c43a_JaffaCakes118.exe windows:4 windows x86 arch:x86
83bc15acea0cdaf10934cdbca0191b7e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
rpcrt4
UuidCreate
kernel32
CreateDirectoryW
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
lstrcpyW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SetEvent
lstrcmpiW
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
CreateEventW
SystemTimeToFileTime
GetSystemTime
FreeLibrary
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetLastError
GetModuleFileNameW
ResetEvent
WaitForSingleObject
GetTickCount
WaitForMultipleObjects
SetThreadPriority
FileTimeToSystemTime
GetCurrentThread
CreateProcessW
CreateThread
lstrcatW
GetCurrentThreadId
GetCommandLineW
FreeConsole
AllocConsole
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
ExitProcess
TlsFree
GetSystemTimeAsFileTime
TlsGetValue
TlsSetValue
TlsAlloc
ReleaseMutex
lstrlenW
InterlockedIncrement
lstrcpynW
CloseHandle
Sleep
GetExitCodeThread
GetModuleHandleW
SetThreadPriorityBoost
CreateMutexA
GetVersionExA
GetModuleHandleA
FormatMessageW
LocalAlloc
LocalFree
FindNextFileW
FindFirstFileW
FindClose
user32
CharUpperW
wsprintfW
PostMessageW
RegisterWindowMessageW
CharNextW
TranslateMessage
DispatchMessageW
GetMessageW
PostThreadMessageW
advapi32
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
shell32
SHGetSpecialFolderPathW
ole32
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateFreeThreadedMarshaler
CoInitializeEx
CoUninitialize
CoSuspendClassObjects
CoRevokeClassObject
CoRegisterClassObject
CoResumeClassObjects
CoDisconnectObject
CoCreateGuid
StringFromGUID2
oleaut32
RegisterTypeLi
VarBstrCmp
VarBstrCat
VariantCopyInd
SafeArrayCreate
SafeArrayRedim
SafeArrayDestroy
SafeArrayLock
SafeArrayUnlock
SafeArrayCopy
SafeArrayGetVartype
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocStringLen
SysStringLen
UnRegisterTypeLi
LoadTypeLi
VarUI4FromStr
VariantClear
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysAllocString
GetErrorInfo
nmsqldb
sqlite3_errmsg16
sqlite3_open16
sqlite3_reset
sqlite3_step
sqlite3_errmsg
sqlite3_bind_int64
sqlite3_last_insert_rowid
sqlite3_column_text16
sqlite3_registerCaseFoldingCollations
sqlite3_column_int64
sqlite3_bind_double
sqlite3_bind_text16
sqlite3_value_text16
sqlite3_result_int64
sqlite3_value_double
sqlite3_value_int64
sqlite3_value_type
sqlite3_create_function16
sqlite3_column_int
sqlite3_bind_null
sqlite3_bind_int
sqlite3_column_double
sqlite3_column_type
sqlite3_prepare
sqlite3_close
sqlite3_finalize
sqlite3_prepare16
shfolder
SHGetFolderPathW
shlwapi
PathIsPrefixW
PathAppendW
PathRemoveFileSpecW
PathFindExtensionW
PathIsUNCW
PathCreateFromUrlW
UrlIsW
UrlCanonicalizeW
UrlCreateFromPathW
PathIsURLW
SHRegCloseUSKey
SHRegCreateUSKeyW
SHRegWriteUSValueW
SHRegQueryUSValueW
UrlCombineW
msvcp71
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?to_int_type@?$char_traits@D@std@@SAHABD@Z
?_Nomemory@std@@YAXXZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??$?9GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AViterator@12@V312@@Z
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AViterator@12@XZ
?at@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
msvcr71
_wcsicmp
_i64tow
__CxxFrameHandler
_vsnwprintf
??3@YAXPAX@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
memmove
free
wcslen
wcscmp
malloc
_purecall
??_V@YAXPAX@Z
_except_handler3
realloc
wcsncpy
_wsplitpath
_vscwprintf
wcstod
_wcstoi64
wcsrchr
_ltow
_beginthreadex
_vsnprintf
fclose
fopen
fprintf
sscanf
sprintf
fputs
fgets
ftell
fseek
isspace
tolower
isalpha
isalnum
strncmp
strchr
strncpy
wcscpy
?what@exception@@UBEPBDXZ
??8type_info@@QBEHABV0@@Z
isdigit
_itow
swscanf
memset
_callnewh
__security_error_handler
??1type_info@@UAE@XZ
__dllonexit
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
_amsg_exit
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_wcsdup
_wtol
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA
Sections
.text Size: 352KB - Virtual size: 349KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 76KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE