avifil32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4506e39dbd9793d9131f508631ad45b7_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4506e39dbd9793d9131f508631ad45b7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4506e39dbd9793d9131f508631ad45b7_JaffaCakes118
-
Size
2.8MB
-
MD5
4506e39dbd9793d9131f508631ad45b7
-
SHA1
251896091925ac83c25c72598ef8e8b338e274fc
-
SHA256
699fe9e43d51c71df4ae2dc02b73df591e5bebaf956ceecb8f9eaf9256f5816a
-
SHA512
24d9e7a7383f0a96d8ff443bdce43b714f8adc1bcff7b7e48c2f8287cc970150dc0fc57419bd5214d43259d811af6bb5f7a33b108c2afc679a242ac861111e42
-
SSDEEP
49152:7mlcum5YLv0/l+u+tidLQMkCMeMNCKrrAvFVynDHzXou:7k05I0/l+mHZMNCcrAWnDHz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4506e39dbd9793d9131f508631ad45b7_JaffaCakes118
Files
-
4506e39dbd9793d9131f508631ad45b7_JaffaCakes118.exe windows:5 windows x86 arch:x86
768867b71ef9f376324c94e58cc37983
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
__dllonexit
_adjust_fdiv
malloc
_initterm
free
_onexit
wcscpy
_wcsicmp
_wcsnicmp
wcslen
_wfullpath
_ultow
wcschr
wcsstr
_wcslwr
_except_handler3
swprintf
_purecall
wcsrchr
wcsncmp
wcscat
ntdll
RtlCopySid
RtlLengthSid
RtlGUIDFromString
RtlFreeSid
RtlExpandEnvironmentStrings_U
RtlUnicodeStringToInteger
RtlConvertSidToUnicodeString
RtlIntegerToUnicodeString
RtlEqualSid
RtlNtStatusToDosError
RtlAllocateAndInitializeSid
RtlFreeUnicodeString
RtlCopyUnicodeString
RtlCreateUnicodeString
RtlInitUnicodeString
NtQueryInformationToken
kernel32
DeleteCriticalSection
CloseHandle
LoadLibraryA
DebugBreak
SetLastError
WriteFile
SetFilePointer
lstrlenW
ExpandEnvironmentStringsW
OutputDebugStringW
GetCurrentProcessId
GetLocalTime
FormatMessageW
GetCurrentThread
CopyFileW
SetFileAttributesW
GetFileAttributesW
CreateDirectoryW
FindClose
FindNextFileW
DeleteFileW
RemoveDirectoryW
lstrcmpiW
lstrcmpW
DisableThreadLibraryCalls
lstrcpyW
WritePrivateProfileStringW
GetPrivateProfileSectionW
MoveFileExW
GetTempFileNameW
CompareFileTime
GetModuleHandleA
GetFileAttributesExW
WritePrivateProfileSectionW
MoveFileW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
lstrcatW
GetVolumeInformationW
PrivCopyFileExW
Sleep
GetPrivateProfileStringW
GetSystemTime
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
LocalFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CompareStringW
FreeLibrary
GetProcAddress
LoadLibraryW
InitializeCriticalSectionAndSpinCount
LocalAlloc
FindFirstFileW
CreateFileW
GetCurrentProcess
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
advapi32
RevertToSelf
RegCreateKeyExW
RegSetValueExW
RegCloseKey
CloseEventLog
OpenEventLogW
RegQueryValueExW
RegOpenKeyExW
CopySid
GetLengthSid
GetTokenInformation
OpenThreadToken
ReportEventW
SetFileSecurityW
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
DuplicateToken
RegOpenKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
GetFileSecurityW
GetSecurityDescriptorOwner
CheckTokenMembership
AllocateAndInitializeSid
InitializeAcl
AddAccessAllowedAce
GetAce
SetSecurityDescriptorControl
SetSecurityDescriptorDacl
FreeSid
user32
LoadStringW
wsprintfW
wvsprintfW
shell32
SHGetFolderPathW
mpr
WNetUseConnectionW
WNetCancelConnection2W
ole32
CoInitialize
CoUninitialize
secur32
GetUserNameExW
netapi32
NetUserGetInfo
DsGetDcNameW
NetApiBufferFree
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2.7MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ