wabmig.pdb
Static task
static1
General
-
Target
5994757ec0f63591a2d20c8d4f3efeaa_JaffaCakes118
-
Size
462KB
-
MD5
5994757ec0f63591a2d20c8d4f3efeaa
-
SHA1
cc9cca12e08f801327a417c95e137eda58d790e5
-
SHA256
a3dda9b442144e6c36875404ad0deb3614e17c5f09889ecee156d96f6516258e
-
SHA512
95f5245f0b380be6f912df0116e621afa0e63a5b104724b19b9a00380b9555069eeb36aec79b5b82cc8bd52b5dbe73f4f00af13ab9005fa93512c19582a305b4
-
SSDEEP
12288:kyEMCnhwLOln2DBeM1MZrjaRge/oqD5Kj:RCnHl2BeM10j/e/+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5994757ec0f63591a2d20c8d4f3efeaa_JaffaCakes118
Files
-
5994757ec0f63591a2d20c8d4f3efeaa_JaffaCakes118.exe windows:10 windows x64 arch:x64
29c9eb4be844e75328ad3dcd8fd99253
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
RegOpenKeyExW
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExW
RegQueryValueExA
RegCloseKey
RegQueryValueExW
kernel32
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineW
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
LocalAlloc
CompareStringOrdinal
MultiByteToWideChar
GetFileAttributesA
HeapSetInformation
LocalFree
WideCharToMultiByte
FormatMessageA
Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetLastError
GetACP
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RegisterApplicationRestart
CreateThread
CloseHandle
user32
GetDlgItem
GetWindowLongPtrA
SetWindowLongPtrA
SendMessageA
PeekMessageA
SetDlgItemTextA
TranslateMessage
DefWindowProcA
IsWindowEnabled
MessageBoxW
SetDlgItemTextW
ShowWindow
LoadStringW
EndDialog
PostMessageA
DialogBoxParamW
EnableWindow
IsDlgButtonChecked
SendMessageW
LoadStringA
DispatchMessageA
msvcrt
memset
?terminate@@YAXXZ
_commode
_fmode
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
toupper
__C_specific_handler
_strnicmp
_acmdln
comctl32
ord17
ntdll
RtlVirtualUnwind
WinSqmSetDWORD
RtlCaptureContext
RtlLookupFunctionEntry
WinSqmAddToStream
shell32
CommandLineToArgvW
shlwapi
PathAppendA
PathRemoveFileSpecA
SHQueryValueExA
StrCmpW
ord487
PathFindFileNameA
ole32
CoInitializeEx
CoUninitialize
CoWaitForMultipleHandles
CoCreateInstance
CoInitialize
oleaut32
SysFreeString
SysAllocString
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 540B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 396KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ