sysocmgr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
44756c2884fbdfea7a87b3b0f8f2a7ae_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
44756c2884fbdfea7a87b3b0f8f2a7ae_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
44756c2884fbdfea7a87b3b0f8f2a7ae_JaffaCakes118
-
Size
161KB
-
MD5
44756c2884fbdfea7a87b3b0f8f2a7ae
-
SHA1
430cae3f37d18dafd142826ef3b5e8f4e150b34a
-
SHA256
49986ff828214d35aba2fe1ee0f90c333481b7310bf2ed46bd9ded00832f9b64
-
SHA512
ae47d3e98cf0a8507039111af12ce18e6ccc0a9fae3f26bfe42355547793310bdafde5a5240b0b47bac638cb9f97899a87680a24415bab1692fe8624a67761c8
-
SSDEEP
3072:Or6qv6/as2nujSUlbW5x9S3Zs/IUep4S7n+OKY:G6qC/knSSUlzZeevy5Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44756c2884fbdfea7a87b3b0f8f2a7ae_JaffaCakes118
Files
-
44756c2884fbdfea7a87b3b0f8f2a7ae_JaffaCakes118.exe windows:5 windows x86 arch:x86
e43f40f1941053f96a21a271cdc54bb1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
PDB Paths
Imports
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenThreadToken
kernel32
GetModuleHandleA
GetLastError
GetModuleHandleW
GetProcAddress
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
FreeLibrary
lstrcmpiW
lstrcpyW
WideCharToMultiByte
GetCurrentProcess
GetCurrentThread
GetFullPathNameW
ExpandEnvironmentStringsW
SetCurrentDirectoryW
GetCurrentDirectoryW
LoadLibraryA
ReleaseMutex
Sleep
CloseHandle
CreateThread
CreateMutexW
lstrcatW
GetVersionExW
VirtualProtect
LocalFree
GetCurrentProcessId
lstrcpynW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersionExA
HeapFree
HeapAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
InterlockedExchange
VirtualQuery
VirtualAlloc
HeapReAlloc
LCMapStringA
LCMapStringW
GetSystemInfo
GetLocaleInfoA
GetCPInfo
GetStringTypeA
GetStringTypeW
FormatMessageW
LocalAlloc
gdi32
GetDeviceCaps
user32
SetWindowLongW
PostMessageW
GetParent
EndDialog
ReleaseDC
GetDC
SendMessageW
GetWindowRect
SystemParametersInfoW
MoveWindow
LoadCursorW
ExitWindowsEx
wvsprintfW
LoadStringW
SetCursor
DialogBoxParamW
AllowSetForegroundWindow
MessageBoxW
ocmanage
OcCreateOcPage
OcGetWizardPages
OcSubComponentsPresent
OcTerminate
OcCreateSetupPage
OcRememberWizardDialogHandle
OcInitialize
shell32
ord730
ntdll
DbgPrintEx
setupapi
pSetupFree
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 102KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hradgjd Size: 31KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cywdnyj Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE