t:\Tpm-sw\Tss\bin\IA32\win\Release\IFXTCS.pdb
Behavioral task
behavioral1
Sample
2fc281bd8f1dddd0b80cdc5b446f58ca_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2fc281bd8f1dddd0b80cdc5b446f58ca_JaffaCakes118.exe
Resource
win10v2004-20240708-en
General
-
Target
2fc281bd8f1dddd0b80cdc5b446f58ca_JaffaCakes118
-
Size
872KB
-
MD5
2fc281bd8f1dddd0b80cdc5b446f58ca
-
SHA1
9a9922c069c439ef7fc94b3b7a8989823338e241
-
SHA256
c69fab0fce530f590f1985b8c1efae13fb28aff4b4059a9ef9424e1408c30e0f
-
SHA512
69b9423a6db0d17e53a4bc2386a666ac8d3a9368d5b68054c3b7955d64d2a9ff86912753f5e9e2fa7e1389f460a1cd061a79f302693aee6b800d5ed1fd6ccfd2
-
SSDEEP
12288:TsYkWzRvurs/3bcciMIugtosV1u7DViKI7MHdwt+scn0NUEAL:TlkWd0PciCgtosVo7Q7MHdwt+sPg
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2fc281bd8f1dddd0b80cdc5b446f58ca_JaffaCakes118
Files
-
2fc281bd8f1dddd0b80cdc5b446f58ca_JaffaCakes118.exe windows:4 windows x86 arch:x86
6efb6169b954a927f82bf935bf7665e6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
mfc71u
ord764
ord266
ord265
ord1021
ord1908
ord1182
ord1178
ord631
ord386
ord629
ord384
ord2279
ord1271
ord577
ord870
ord899
ord283
ord2460
ord2895
ord776
ord293
ord2311
ord896
ord5485
ord2261
ord287
ord5398
ord2121
ord2468
ord774
ord280
ord3927
ord2271
ord2260
ord860
ord4078
ord1248
ord6009
ord3383
ord1476
ord2745
ord2742
ord1479
ord282
ord2926
ord6111
ord5711
ord762
msvcr71
_initterm
towupper
wcsncpy
_purecall
wcsncat
_vsnwprintf
_ftime
_snwprintf
_wctime
fwprintf
_wrename
_wremove
_wfopen
_wcsupr
_wsplitpath
fclose
_wutime
fflush
wcsstr
_wcslwr
__CxxFrameHandler
_CxxThrowException
memcpy
memset
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
memmove
??0exception@@QAE@XZ
wcsncmp
mbstowcs
memcmp
??0bad_cast@@QAE@ABV0@@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@PBD@Z
_except_handler3
?_set_new_mode@@YAHH@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
free
_controlfp
_onexit
__dllonexit
?terminate@@YAXXZ
__security_error_handler
??1type_info@@UAE@XZ
_CRT_RTC_INIT
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
wcslen
__wgetmainargs
_amsg_exit
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
wcstol
realloc
malloc
wcscmp
kernel32
GetProcessHeap
HeapFree
HeapAlloc
GetModuleFileNameA
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
DebugBreak
LoadLibraryA
GetVersionExA
ExitProcess
GetStartupInfoW
GetModuleHandleA
GetDiskFreeSpaceExW
GetVolumeInformationW
GetDriveTypeW
GetStringTypeExW
GetFullPathNameW
VerSetConditionMask
VerifyVersionInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
LocalFree
SetLastError
ExpandEnvironmentStringsW
GetCurrentProcess
lstrcatW
lstrcpynW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
lstrcpyW
GetModuleHandleW
lstrlenW
InterlockedDecrement
InterlockedIncrement
GetCommandLineW
lstrcmpiW
CreateEventW
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
RaiseException
ResetEvent
WaitForMultipleObjects
WaitForSingleObject
Sleep
SetThreadPriority
GetCurrentThread
GetLastError
ResumeThread
GetProcAddress
LoadLibraryW
FreeLibrary
OutputDebugStringW
CloseHandle
ReadFile
GetFileSize
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
CreateFileW
GetVersion
GetSystemDirectoryW
GetComputerNameW
GetModuleFileNameW
OpenMutexW
CreateMutexW
ReleaseMutex
GetCurrentProcessId
GetCurrentThreadId
SetEvent
user32
UnregisterClassW
wsprintfW
PostThreadMessageW
DispatchMessageW
GetMessageW
LoadStringW
SetForegroundWindow
SetFocus
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
TranslateMessage
PeekMessageW
UnregisterClassA
ReleaseDC
GetDC
CloseDesktop
OpenInputDesktop
CharNextW
MsgWaitForMultipleObjects
gdi32
CreateFontW
GetDeviceCaps
advapi32
RegEnumValueW
CreateServiceW
DeleteService
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetUserNameW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegisterServiceCtrlHandlerExW
SetServiceStatus
FileEncryptionStatusW
DecryptFileW
RegLoadKeyW
RegUnLoadKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertStringSidToSidW
LookupAccountSidW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
LookupAccountNameW
ConvertSidToStringSidW
CryptGenRandom
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
ControlService
RegOpenCurrentUser
GetTokenInformation
OpenThreadToken
OpenProcessToken
SetSecurityDescriptorGroup
IsValidSid
GetLengthSid
CopySid
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegSetValueExW
RegDeleteValueW
StartServiceCtrlDispatcherW
ChangeServiceConfig2W
shell32
SHFileOperationW
SHGetFolderPathW
shlwapi
PathFindExtensionW
PathUnquoteSpacesW
PathFileExistsW
PathRenameExtensionW
PathRemoveFileSpecW
PathRemoveBackslashW
PathAddBackslashW
PathIsDirectoryW
ole32
CoCreateFreeThreadedMarshaler
CoCreateGuid
StringFromCLSID
StringFromGUID2
CoRevokeClassObject
CoRegisterClassObject
CoRevertToSelf
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoQueryClientBlanket
CoImpersonateClient
CoTaskMemRealloc
oleaut32
SysFreeString
VarUI4FromStr
RegisterTypeLi
SysAllocString
UnRegisterTypeLi
LoadTypeLi
msvcp71
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@@Z
?id@?$ctype@G@std@@2V0locale@2@A
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?to_int_type@?$char_traits@G@std@@SAGABG@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
?width@ios_base@std@@QAEHH@Z
?at@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?eof@?$char_traits@G@std@@SAGXZ
?eq_int_type@?$char_traits@G@std@@SA_NABG0@Z
?to_char_type@?$char_traits@G@std@@SAGABG@Z
?is@?$ctype@G@std@@QBE_NFG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?flags@ios_base@std@@QBEHXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?to_int_type@?$char_traits@D@std@@SAHABD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0_Lockit@std@@QAE@H@Z
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@@Z
?_Incref@facet@locale@std@@QAEXXZ
?_Register@facet@locale@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1locale@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
?clear@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?reserve@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?width@ios_base@std@@QBEHXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?eof@?$char_traits@D@std@@SAHXZ
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?to_char_type@?$char_traits@D@std@@SADABH@Z
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ
?is@?$ctype@D@std@@QBE_NFD@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
ifxsparc
?ArcCreateInstance@IFXTCGArc@@YAPAVISPArcManagement@1@W4TYPE_ARCACCESS@1@@Z
??1CSPDataRecord@IFXTCGArc@@UAE@XZ
??0CSPDataRecord@IFXTCGArc@@QAE@PAVCSPBaseObject@1@@Z
?SetName@CSpArcConfigDataSet@IFXTCGArc@@QAEIABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?QueryValueBinary@CSpArcConfigDataSet@IFXTCGArc@@QAEIABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0AAPAEAAK@Z
?SetKeyBindData@CSpArcTssPsKeyDataSet@IFXTCGArc@@QAEIKPAE@Z
?GetParentKeyInfo@CSpArcTssPsKeyDataSet@IFXTCGArc@@QAEIAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z
?GetBinaryKeyData@CSpArcTssPsKeyDataSet@IFXTCGArc@@QAEIAAKAAPAEAA_N@Z
??0CSpArcTssPsKeyDataSet@IFXTCGArc@@QAE@XZ
?SetUUID@CSpArcTssPsKeyDataSet@IFXTCGArc@@QAEIABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?SetParentKeyInfo@CSpArcTssPsKeyDataSet@IFXTCGArc@@QAEIABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z
??0CSpArcConfigDataSet@IFXTCGArc@@QAE@XZ
?SetBinaryKeyData@CSpArcTssPsKeyDataSet@IFXTCGArc@@QAEIKPAE@Z
?ArcReleaseInstance@IFXTCGArc@@YA_NXZ
Sections
.text Size: 560KB - Virtual size: 558KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 112KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE