C:\Users\admin\Desktop\IntelMervyn Trainer(2)\IntelMervyn Trainer\Release\PiezTrainer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5e0247d18a755666794267d94ef18ccc_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5e0247d18a755666794267d94ef18ccc_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5e0247d18a755666794267d94ef18ccc_JaffaCakes118
-
Size
710KB
-
MD5
5e0247d18a755666794267d94ef18ccc
-
SHA1
6b37b3d1e70e2461b0da82b20192d4deb1a15883
-
SHA256
c9163d34bfd9cdbcff5e2c5ed7a928f75ba3ad592b3bb066519d549dbccee036
-
SHA512
535ca15d65ec7cdf8a5642944ce420ee264a2fc32ce4d363a466162407a24bd12f24ef89f345805076a853deac175ee7433843951ad6d7638a2eaedfea2fc3da
-
SSDEEP
6144:Vm77/sHj7Ui+KcGj7Ui+KcGrN/7Ui+KcGotXO7Ui+KcGb7Ui+KcGo7Ui+KcGSc7U:M77/sKvDaYIQLjIfzT2aS0uxwYbI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e0247d18a755666794267d94ef18ccc_JaffaCakes118
Files
-
5e0247d18a755666794267d94ef18ccc_JaffaCakes118.dll windows:5 windows x86 arch:x86
2c6ffbd9b2610e4056e1ea750c9cf2ce
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
Sleep
GetCurrentProcessId
TerminateThread
CreateDirectoryA
DisableThreadLibraryCalls
CreateThread
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
user32
PostMessageA
MapVirtualKeyA
GetAsyncKeyState
GetWindow
GetWindowThreadProcessId
GetTopWindow
ShowWindow
FindWindowA
MessageBoxA
GetClassNameA
msvcp100
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_BADOFF@std@@3_JB
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Lockit_ctor@_Lockit@std@@SAXH@Z
??Bid@locale@std@@QAEIXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Lockit_dtor@_Lockit@std@@SAXH@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??Bios_base@std@@QBEPAXXZ
??7ios_base@std@@QBE_NXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Xlength_error@std@@YAXPBD@Z
?_Incref@facet@locale@std@@QAEXXZ
?_Xout_of_range@std@@YAXPBD@Z
msvcr100
ungetc
__FrameUnwindFilter
_cexit
rand
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
isdigit
tolower
memmove
??2@YAPAXI@Z
memcpy_s
??3@YAXPAX@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
fclose
fflush
fsetpos
_fseeki64
fgetpos
fputc
fwrite
fgetc
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
_CxxThrowException
??_V@YAXPAX@Z
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
??0bad_cast@std@@QAE@PBD@Z
_lock_file
_unlock_file
setvbuf
shell32
ShellExecuteA
mscoree
_CorDllMain
Sections
.text Size: 97KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 607KB - Virtual size: 606KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ