msninst.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4857ad7b1834494ef1da01d72fe9a5e8_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
4857ad7b1834494ef1da01d72fe9a5e8_JaffaCakes118
-
Size
201KB
-
MD5
4857ad7b1834494ef1da01d72fe9a5e8
-
SHA1
7709a6992fa195d4167cf806d363f39eece6d8d0
-
SHA256
e845521a00cfc6b701206b796e7c89bd3e4cdd968043d3e4e9eced8158a5c8e6
-
SHA512
6a7d608abbf2c1bc5f335b86b2167169f1295f149891defe8c2f2737c586de79b3c1b48e9d449bb4ca908f5a95987ff33f043955a21fc4b39e859622c2c68092
-
SSDEEP
3072:4wk/jpIT6Klkk8kXRcaCYnMym1DQx3SAL7WOQ:4j26Zk8ZTYngGiAmOQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4857ad7b1834494ef1da01d72fe9a5e8_JaffaCakes118
Files
-
4857ad7b1834494ef1da01d72fe9a5e8_JaffaCakes118.exe windows:5 windows x86 arch:x86
ab4a78242e30b5066017e7225694cf93
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptReleaseContext
kernel32
SetEvent
CreateProcessA
GetPrivateProfileIntA
lstrcpynA
DuplicateHandle
GetCurrentProcess
CreateEventA
MapViewOfFile
CreateFileMappingA
GetModuleFileNameA
EnterCriticalSection
GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleA
GetStartupInfoA
GetVersionExA
HeapFree
RtlUnwind
TerminateProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
VirtualQuery
HeapAlloc
VirtualAlloc
HeapReAlloc
IsBadWritePtr
HeapSize
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
VirtualProtect
GetSystemInfo
InterlockedExchange
ReleaseMutex
CloseHandle
UnmapViewOfFile
LeaveCriticalSection
SetUnhandledExceptionFilter
LocalAlloc
GetCommandLineA
MultiByteToWideChar
GetModuleFileNameW
CreateMutexA
WaitForSingleObject
ExitProcess
lstrlenA
lstrlenW
DeleteFileW
FormatMessageA
LocalFree
FreeLibrary
LoadLibraryA
GetProcAddress
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
WideCharToMultiByte
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedCompareExchange
GlobalDeleteAtom
GetSystemDefaultLangID
GetPrivateProfileStringW
FindClose
FindNextFileA
FindFirstFileA
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
FindFirstFileW
InterlockedIncrement
GetWindowsDirectoryA
GlobalAddAtomA
CreateFileW
LocalReAlloc
InterlockedDecrement
GetProcessTimes
QueryPerformanceFrequency
SetFilePointer
GetLocalTime
FlushFileBuffers
GetAtomNameA
lstrcmpA
GetCommandLineW
user32
LoadStringW
LoadStringA
GetSysColor
ReleaseDC
GetDC
SystemParametersInfoW
ExitWindowsEx
RegisterWindowMessageW
MessageBoxA
shfolder
SHGetFolderPathA
gdi32
DeleteObject
GetDeviceCaps
GetPaletteEntries
Sections
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 109KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE