IspiHostAdmin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3fdb952bf83b7e8caf5e8342e65fcdad_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3fdb952bf83b7e8caf5e8342e65fcdad_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3fdb952bf83b7e8caf5e8342e65fcdad_JaffaCakes118
-
Size
13.9MB
-
MD5
3fdb952bf83b7e8caf5e8342e65fcdad
-
SHA1
ff39bc7215fc60ffd1bab484f079eba19bc430ce
-
SHA256
5dcbd9390fdecc784283fafce4c2f1a5f396d314630bfc8849477e0dd569db89
-
SHA512
f4939f7ebade4ad8c9982dbf954a90d5edac007c7425c1b0e4d79f223175183c38878356f6d3483526cd2c766a8e1120448403ed9f9858244ec6306cd198f23e
-
SSDEEP
393216:wFGoQXZZXWZS/P41coHUPL/GwkNWtQ/J41W8PW:Vo+bXWZS/PAckUzuWm4PPW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3fdb952bf83b7e8caf5e8342e65fcdad_JaffaCakes118
Files
-
3fdb952bf83b7e8caf5e8342e65fcdad_JaffaCakes118.exe windows:5 windows x86 arch:x86
ec96422afc52787e57197eb8a9cd2add
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersionExW
GetVersion
GetVersionExA
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ShowWindow
gdi32
SetBkMode
comdlg32
GetSaveFileNameW
advapi32
IsValidSecurityDescriptor
shell32
Shell_NotifyIconW
ole32
OleDuplicateData
oleaut32
SysAllocString
shlwapi
ColorHLSToRGB
comctl32
ImageList_DrawIndirect
msimg32
GradientFill
urlmon
URLDownloadToFileW
uxtheme
EnableThemeDialogTexture
dwmapi
DwmIsCompositionEnabled
gdiplus
GdipCreateBitmapFromScan0
msvcp100
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
msvcr100
_wtol
userenv
UnloadUserProfile
ws2_32
setsockopt
mpr
WNetUseConnectionW
netapi32
NetShareDel
winhttp
WinHttpOpenRequest
crypt32
CryptEncodeObjectEx
version
VerQueryValueW
iphlpapi
ConvertLengthToIpv4Mask
wlanapi
WlanFreeMemory
setupapi
SetupDiOpenDevRegKey
wininet
InternetOpenW
dnsapi
DnsQuery_W
credui
CredPackAuthenticationBufferW
rpcrt4
UuidCreate
psapi
EnumProcessModules
bcrypt
BCryptOpenAlgorithmProvider
ncrypt
NCryptFreeObject
Exports
Exports
??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z
??4_Init_locks@std@@QAEAAV01@ABV01@@Z
sqlite3_csv_init
sqlite3_shathree_init
}����l�� ���:��S݀=��fa]�,�wm$���=T;���+�?�hqX�?�@�q{�rP.�"��9��b���e9��J��""7t��҅����\cH�����{��Lt>@���fF�d�����5���a�BvI�B� }�ҒB�pD���H<zk ��]V7}����5���_����!7�����m���oC���cNY���l&�������� ��y��� C�+�@�ٝB렷[���G�� ��̙Rp�Q���[25bz&�G��Mpq���-���w�j�俊l�t�֡�pf��d����B�Xu>H2�%&q?�#U�{,�����shݱ��8�� ����t�4�-]@������T��Xz����UY\��&�.�q�~IP�J�:��eeĕmΆ!e��b�h���:�ⲕ�Q5se�@�.b���O{�������j`��r���z�D�:Ÿ��ᯏXx7��R<�">pJۍ���G�߮:��3��!���0��ԙ:XE��Ty<��;&��%i3yq�$w�`z����u��F�G$� ���]�$*�����|g��r��*�+�x�u+Q����r�\�By�O��[Q��ۂ|��~�MY�vfΧ&v͘bj| �(#��(%����X�G �NI�읹��SZ�m6\j�BZJ']���x��\AT=�h6ʱ%jS ]�[l��(9A�E$�ga���{]�J��w)Ǡ��=#L�Ԭ̈Qun���>�lia(���''�ޯ<�/���k6dnU=���Y��Я��\sE&�$�/9�����+�ʲϽ����q�j�km' ��I��wk��{1�?x�d��);Z� ~��«�����X�ɠ�$�v�A[�Ĭ�᪵�H-�j�hֳ�Di!·Ϙ�y�}&X�E����Z��3�^�������-��W��GZ!u2"��@}G�&���蘳�3vܡD%�&�B~d_��9��v,՛�a�u�@����1��7ɖk:҇�S���9A�O5[r�:CF�ǔ�r��!P�bߢŶX�\"/V0a�kyq��8/�����a��d#����4�^�x�I �5�$��e�܋B���eg���տPڌ�p�_�����b�n?,0��RGY.��s�H��!��,�%x��s�W�T�|� 5�0��:'8�-��<knQ� Xa�N��I�6���=�9 �p~����`���"��f� ��U�䭆��/�X�������%�o��Gqft�n3Ťe�Ֆ8�#qc?��f�ZO���1��_������9錁�[(����f�j0I��dfܭ5O�(T���$���ʁ,B/��R�㹎���9��<�`��-$���&�z�>9~�5^ߑsDJWY1&���Cu�<� ����z)S-Z�^[8���8_H"JJ=��Lؓ���V���'C�#�3)�n���|��Xo��)�n�����~�i�T�\�<��X���-,!�k��cz��ZA8[&����[�z��H+@���^q�$��t�oY�U��nM(m�����m����HcJ�89�;�>����`4.�e�� !D/�j35�����ir�aƴ�����i?+�J�tkZ��(W��k�ռ��g����6�f@#�Q5�Uf!��g��~G��?#�R��˶k�P�ϊ��ߵ8�)Ff�{c�|x�`��{��EgX^�D7,^"�&|�ZC�{1�M�D�Rr�D����*�%��R�f�ѻ�O _��3<b�S�s��Ͷ��U����ڤ�ê�I�3�%�q(�}:�&�1�j!W�@26�AL�A��!�O2��]G���# x .v��zn�Ip�<CN�B��wc���+������-���$��1�mQL�]��R��,�"�i{���d��w����Jc� ��R$|^l���ol�E�\�,Ҥ�~w�#~{\��j��L�:04����w��л���Ǿ��m�l�����+�h hIP�L2���p�P�u�_=s�RT����;�qqhe�{��樶�HI��|�� A�;9B�% 6/�И'�s$0!݆jB5�j�Oۑ��X�c� g�Ǔ�Ɇ�Uٺ��!�#�$�+��&&Ə� ���u1`e����0�1�oLO=�A�`�����I�$R�4Ü�'�E�I�B,���ur�<�|k���Wqj����6�못�B�? C.���R[.�"�S��� hw�9��`1/!ܧ��DXN?����+���o�m��'2�P�Ê�)Ő:z�9�I�'�"��ے���f�$�5(� � C:��B?�%1�b����B� q>���c"�)��I�ȝ����r �J:F�FWI��۰�=9� �,B�eC_��j��'����_�T�)�%��a0��cA�1����Bm�ꄯ\�\p��D��q�< u��$�%k!��h� a�z'�}����&[dA�����ְ���o���4��������S�RR�^��z��u��* ��x�ai�Xxf����ͻ��A�WN? �p����~b��j�R��� m�ys��{ŝ�\B���,�{O��L��< ������7ef!3��N�'�n'���t[��ӬzR�Y������N,@*2��I<q� ? �[�{@�A߾elC.��hB�Zm� O�����WA骔��d� ���~�3�w����L.('̮������9��ם�;ڙUɀ�풫c�NiF20��ŎQ�hh�(D�<k�Iv�3.��`Dl�q+�6���g��;^�2��N��4CȦ��(�,��1� -�Ե;\�>�Op�wh�4�N)��J�< J���0đ�U�{��鞯��n�q�G���l+b�챶w��q(�᯲l�m�7 C���eu��I��n4����Yg��,���c�����E��x�_�Ӽ� ��v��c�YM��� �"��C��#��Gp���]$���#�;����oF�8���$*A-<�<��6X�H%B��J���R��b8�����N����*��Xk���-�5�a�X���v�2��:�XT)46��v]-����ce��2P�]�����k�$�Q�IH�B���T���Za&�m�z[����I��㣤V�
Sections
.text Size: - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rodata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1001KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.datax Size: - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 10.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 13.8MB - Virtual size: 13.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 356B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ