DrvQry.pdb
Behavioral task
behavioral1
Sample
358bf8f023256ce6c57192db1e58e62e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
358bf8f023256ce6c57192db1e58e62e_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
358bf8f023256ce6c57192db1e58e62e_JaffaCakes118
-
Size
205KB
-
MD5
358bf8f023256ce6c57192db1e58e62e
-
SHA1
8fc919785893f1f24c379171ee0696619f9545be
-
SHA256
8f49aee300c6554d46c598753888adb9742daf57662def35bdf076a14a2b45ef
-
SHA512
617d3e16bf1a18c9c244c54b877b020e9a728d9739aa5cf10ef7f233b872b7b380b24ee9c3e26de8598c02b836c184f28cde8a692dc0c1b855b164d9de391271
-
SSDEEP
6144:96nM7Rdql8lcJj7eekYegnYpHhapN7Ncczv3vp4fjWq:cn6dAOcJYhKO
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 358bf8f023256ce6c57192db1e58e62e_JaffaCakes118
Files
-
358bf8f023256ce6c57192db1e58e62e_JaffaCakes118.exe windows:5 windows x86 arch:x86
ee4bd6ff50d524711713390790f36b1a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_cexit
_XcptFilter
_exit
_c_exit
__winitenv
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
??2@YAPAXI@Z
free
__CxxFrameHandler
malloc
wcscpy
wcstok
?terminate@@YAXXZ
_iob
__set_app_type
_except_handler3
_CxxThrowException
wcschr
_wcsicmp
_wsetlocale
??1type_info@@UAE@XZ
_controlfp
exit
_ltow
_wtoi
wcslen
calloc
wcstod
wcstol
wcsncmp
_wcsnicmp
realloc
fflush
fprintf
strtok
wcsstr
_wcsnset
wcscat
_strnicmp
_stricmp
localtime
??3@YAXPAX@Z
kernel32
FileTimeToSystemTime
GetComputerNameExW
GetConsoleMode
SetConsoleMode
ReadFile
ReadConsoleW
MultiByteToWideChar
LoadLibraryW
FreeLibrary
lstrcpynW
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
GetModuleHandleA
LocalFree
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetStdHandle
WriteConsoleW
FormatMessageW
LocalAlloc
SetLastError
GetNumberFormatW
InterlockedDecrement
CreateFileW
CreateFileMappingW
CloseHandle
MapViewOfFile
GetDateFormatW
GetTimeFormatW
lstrcatW
UnmapViewOfFile
InterlockedIncrement
lstrcmpW
lstrcmpiW
lstrlenW
lstrcpyW
GetLastError
GetProcAddress
GetModuleHandleW
GetLocaleInfoW
GetUserDefaultLCID
user32
LoadStringW
wsprintfW
CharUpperW
mpr
WNetAddConnection2W
WNetCancelConnection2W
WNetGetLastErrorW
ole32
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoTaskMemAlloc
oleaut32
SysAllocString
SysStringLen
SysFreeString
VariantInit
VariantCopy
VariantChangeType
VariantClear
SysAllocStringByteLen
framedyn
?Compare@CHString@@QBEHPBG@Z
?Format@CHString@@QAAXPBGZZ
?ReleaseBuffer@CHString@@QAEXH@Z
??YCHString@@QAEABV0@PBG@Z
?Left@CHString@@QBE?AV1@H@Z
?FindOneOf@CHString@@QBEHPBG@Z
?Mid@CHString@@QBE?AV1@H@Z
??4CHString@@QAEABV0@ABV0@@Z
?Find@CHString@@QBEHG@Z
?GetBuffer@CHString@@QAEPAGH@Z
??0CHString@@QAE@PBG@Z
??0CHString@@QAE@XZ
??4CHString@@QAEABV0@PBG@Z
??1CHString@@QAE@XZ
?GetData@CHString@@IBEPAUCHStringData@@XZ
?GetBufferSetLength@CHString@@QAEPAGH@Z
shlwapi
StrCmpNW
secur32
GetUserNameExW
ws2_32
WSAStartup
WSAGetLastError
inet_addr
gethostbyaddr
WSACleanup
netapi32
NetApiBufferFree
NetServerGetInfo
Sections
.text Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 21B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE