C:\bin\avguard.exe\MGReleaseWKS\avguard.pdb
Static task
static1
Behavioral task
behavioral1
Sample
310937facad94873d8c51a51c795a10a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
310937facad94873d8c51a51c795a10a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
310937facad94873d8c51a51c795a10a_JaffaCakes118
-
Size
263KB
-
MD5
310937facad94873d8c51a51c795a10a
-
SHA1
dfec8b32f9bae108450002389e1c27154930cfba
-
SHA256
d4492b53da06a1dcfb4e2bd938bf9d6f1a7a37157fed9ef4fd84f7f332cbcc7f
-
SHA512
9ddd1f3c39dd03a5258c9c789d41f270a8b76615cce7e98d484ce8a3bb826ae7518ecc2979a3d0237120edf112d07de31cf8827ef60f29eca8e42d965cbda9b3
-
SSDEEP
6144:41zuTFThg/CpSK7mXEAy0dGlSCb1H/UuHO4fEL:416YqSK7UdmfLM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 310937facad94873d8c51a51c795a10a_JaffaCakes118
Files
-
310937facad94873d8c51a51c795a10a_JaffaCakes118.exe windows:6 windows x86 arch:x86
8458313e4c17c184c450131ce077c6aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathIsDirectoryW
kernel32
GetDateFormatW
CopyFileW
GetTimeFormatW
GetCurrentProcess
OpenProcess
GetStartupInfoW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
lstrcpynW
lstrlenW
MoveFileW
CreateSemaphoreW
SetFileAttributesW
DeviceIoControl
WaitForMultipleObjects
ConnectNamedPipe
GetModuleHandleW
CreateNamedPipeW
GetVersionExW
GetOverlappedResult
SetLastError
QueryPerformanceFrequency
GetWindowsDirectoryW
WaitForSingleObject
SetEvent
GetLastError
QueryPerformanceCounter
ReleaseSemaphore
GetTickCount
GetExitCodeProcess
GetComputerNameW
SetErrorMode
DeleteFileW
GetCurrentThreadId
GetPrivateProfileIntW
IsBadReadPtr
GetSystemTimeAsFileTime
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
QueryDosDeviceW
RemoveDirectoryW
EnterCriticalSection
GetTempPathW
WritePrivateProfileStringW
ReadFile
LeaveCriticalSection
InitializeCriticalSection
WriteFile
GetPrivateProfileStringW
SetEndOfFile
SetFilePointer
CreateMutexW
GetFileSize
GetCurrentProcessId
InterlockedExchangeAdd
GetLocalTime
InterlockedCompareExchange
OpenEventW
LocalAlloc
Sleep
GetProcAddress
GetModuleFileNameW
LoadLibraryW
FreeLibrary
ExpandEnvironmentStringsA
lstrlenA
MultiByteToWideChar
GetExitCodeThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedExchange
LoadLibraryA
GetFileAttributesW
LoadLibraryExW
VerSetConditionMask
VerifyVersionInfoW
CreateEventW
CloseHandle
FormatMessageW
LocalFree
FindFirstFileW
CreateDirectoryW
CreateFileW
FindClose
ResetEvent
CreateProcessW
FindNextFileW
user32
CharUpperW
wsprintfW
LoadStringW
GetForegroundWindow
OemToCharBuffW
advapi32
RegSetValueExW
RegDeleteValueW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExA
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
GetSecurityDescriptorDacl
AdjustTokenPrivileges
BuildExplicitAccessWithNameW
FreeSid
SetEntriesInAclW
SetSecurityInfo
AllocateAndInitializeSid
DuplicateTokenEx
GetSecurityInfo
LookupPrivilegeValueW
SetTokenInformation
CreateProcessAsUserW
EqualSid
GetTokenInformation
GetSidSubAuthorityCount
GetUserNameW
GetSidSubAuthority
OpenProcessToken
GetSidIdentifierAuthority
LookupAccountSidW
ReportEventW
RegisterServiceCtrlHandlerW
SetServiceStatus
DeregisterEventSource
StartServiceCtrlDispatcherW
RegisterEventSourceW
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegOpenKeyExA
msvcr90
strtok_s
strncpy_s
strnlen
_vsnwprintf_s
_filelength
_read
_lseek
_wsopen
strtoul
realloc
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
_initterm
atoi
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_crt_debugger_hook
?terminate@@YAXXZ
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
??_U@YAPAXI@Z
??_V@YAXPAX@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
memmove_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??2@YAPAXI@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_beginthread
__CxxFrameHandler3
_wsplitpath_s
wcscpy
iswalnum
abort
vswprintf_s
_wfopen_s
wcscat_s
swscanf_s
wcsncpy_s
wcsncat_s
wcscmp
wcslen
_errno
memcpy
_swprintf
memset
srand
rand
_endthread
_close
fclose
?_wsopen@@YAHPB_WHHH@Z
_wfopen
wcscpy_s
_wcsdup
_time64
_initterm_e
toupper
swprintf_s
wcstok
towupper
wcstombs
wcsncmp
_wcsupr
_wcsnicmp
calloc
memmove
swscanf
mbstowcs
strncat
exit
strncpy
_vswprintf
strchr
strncmp
_waccess
_wsplitpath
_snwprintf
_wcsicmp
_vsnwprintf
wcsstr
wcsrchr
_beginthreadex
wcsncat
wcsncpy
malloc
free
_wtoi
wcschr
_strupr
_strnicmp
fgetwc
??0exception@std@@QAE@ABQBD@Z
_purecall
iswspace
msvcp90
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1locale@std@@QAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??0_Lockit@std@@QAE@H@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
?_Id_cnt@id@locale@std@@0HA
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@
??_7ios_base@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@_W@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_WH@Z
?seekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@H@2@JHH@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHPB_WH@Z
?_Xsgetn_s@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHPA_WIH@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHPA_WH@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?underflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?pbackfail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
libdb44
??0Db@@QAE@PAVDbEnv@@I@Z
??1Dbt@@QAE@XZ
??0Dbt@@QAE@XZ
??0Dbt@@QAE@PAXI@Z
??1Db@@UAE@XZ
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
shell32
ShellExecuteW
ole32
OleRun
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoInitialize
oleaut32
SysAllocStringByteLen
SysStringByteLen
SysFreeString
GetErrorInfo
SysAllocString
Sections
.text Size: 190KB - Virtual size: 189KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ