DfrgNtfs.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3538c5f124136cc14b9b9a491e42e90e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3538c5f124136cc14b9b9a491e42e90e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3538c5f124136cc14b9b9a491e42e90e_JaffaCakes118
-
Size
129KB
-
MD5
3538c5f124136cc14b9b9a491e42e90e
-
SHA1
d84dea81c6a7d86c0c17dba80b559e81bbd50f4a
-
SHA256
4feab37946d4d458dcf13bdc38b59841b99d423e1d59f6c93e5824284e6dd8b5
-
SHA512
de6c4016cbfb992e7f229b3df7d4d6e7ac7840e868bfff1a8fc2ecbc90d5e84442c1e1d22577d4389452a44a27e3f00d0b73df891a3048d6c32b81c882c8dede
-
SSDEEP
3072:vX5+eo9WoPLa0Q9CDAxsZc9mnuDYh1UHf2ig:f8L9WYLQQD2Mqmnx1U+i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3538c5f124136cc14b9b9a491e42e90e_JaffaCakes118
Files
-
3538c5f124136cc14b9b9a491e42e90e_JaffaCakes118.exe windows:5 windows x86 arch:x86
2809f39c7e3353da3419c977d3747e72
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_controlfp
_onexit
__dllonexit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_ftol
swscanf
iswctype
_wcsicmp
_fmode
_wfopen
fgetws
fclose
wcscmp
localeconv
atoi
_local_unwind2
sprintf
towupper
swprintf
wcsstr
wcscat
wcsrchr
wcschr
wcscspn
wcsncmp
wcsncat
wcscpy
memmove
??3@YAXPAX@Z
??2@YAPAXI@Z
wcslen
wcsncpy
_wtoi
_except_handler3
advapi32
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
AllocateAndInitializeSid
SetEntriesInAclW
LookupPrivilegeValueW
OpenProcessToken
SetSecurityDescriptorDacl
FreeSid
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
AdjustTokenPrivileges
kernel32
FlushFileBuffers
SetFilePointer
OutputDebugStringA
GetLocalTime
LocalFree
SetErrorMode
DeviceIoControl
GlobalHandle
GetFileInformationByHandle
ExitThread
QueryPerformanceFrequency
GetComputerNameW
SetEvent
OpenEventW
GetCommandLineW
CreateThread
GetSystemPowerStatus
GetVersionExW
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcess
GlobalLock
GlobalFree
GlobalReAlloc
GlobalUnlock
GlobalSize
GlobalAlloc
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
ReadFile
WriteFile
InterlockedIncrement
InterlockedDecrement
Sleep
CloseHandle
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrcpyW
GetFileSize
CreateFileW
ReleaseMutex
lstrcatW
FormatMessageW
GetCurrentThreadId
lstrlenW
GetTimeFormatW
GetDateFormatW
WaitForSingleObject
lstrcpynW
SizeofResource
FindResourceW
lstrcmpiW
CompareStringW
ExpandEnvironmentStringsW
GetSystemWindowsDirectoryW
SystemTimeToFileTime
GetVolumeInformationW
GetVolumeNameForVolumeMountPointW
GetDriveTypeW
FindVolumeMountPointClose
FindNextVolumeMountPointW
FindFirstVolumeMountPointW
LoadLibraryW
lstrcmpW
gdi32
GetStockObject
user32
LoadStringW
CharUpperW
wvsprintfA
SendMessageW
MessageBoxW
RegisterClassW
LoadCursorW
CreateWindowExW
SetTimer
KillTimer
PostQuitMessage
DestroyWindow
DispatchMessageW
TranslateMessage
GetMessageW
PostMessageW
wsprintfW
DefWindowProcW
ntdll
NtQueryVolumeInformationFile
RtlInitializeGenericTableAvl
NtQueryInformationFile
RtlEnumerateGenericTableLikeADirectory
RtlDeleteElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlEnumerateGenericTableAvl
NtFsControlFile
NtWaitForSingleObject
RtlNumberGenericTableElementsAvl
comctl32
ord17
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ole32
CoUninitialize
CoCreateInstanceEx
CLSIDFromString
ReleaseStgMedium
CoInitializeEx
CoRegisterClassObject
vssapi
ord5
Sections
.text Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gxgught Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE