d:\nsc5.2\output\cfw\sys\im\i386\ncfg.pdb
Behavioral task
behavioral1
Sample
5a644b7bf2fb36ca48b009f0cb74e6d0_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5a644b7bf2fb36ca48b009f0cb74e6d0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5a644b7bf2fb36ca48b009f0cb74e6d0_JaffaCakes118
-
Size
229KB
-
MD5
5a644b7bf2fb36ca48b009f0cb74e6d0
-
SHA1
9df00f6e116453c8d8d1a0c6900d11433b98dc8c
-
SHA256
853bfd0770cd81c7b497649bab7326762b068a1bbb7339fb381fb71f85b4240c
-
SHA512
ecfde82b5293cabe77a655aa4132cab4f8cdf58ac7ce27d85d3833949ded2db8712bf7b228c1b862c5a9f4a8606c3f3c180824664ac160ea03c2929c3d40c095
-
SSDEEP
3072:PJocb9k1bUYQydGW+tToSt2J8iaerDtfj6Rwmtf+34xqgmFNDttxFwPra2Ht:Gcb9cbUYQyeoCiDftj6JUgoDjIm2N
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a644b7bf2fb36ca48b009f0cb74e6d0_JaffaCakes118
Files
-
5a644b7bf2fb36ca48b009f0cb74e6d0_JaffaCakes118.exe windows:6 windows x86 arch:x86
71a30e4c12bbb7692fe054def7265ea0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
kernel32
LoadLibraryW
FreeLibrary
GetLastError
Sleep
GetVersionExW
DeleteFileW
GetWindowsDirectoryW
GetProcAddress
FindNextFileW
FindFirstFileW
CloseHandle
GetCurrentProcess
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
VirtualQuery
GetSystemInfo
GetVersionExA
RaiseException
RtlUnwind
HeapFree
HeapAlloc
SetUnhandledExceptionFilter
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
TerminateProcess
UnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
WideCharToMultiByte
LCMapStringW
HeapReAlloc
HeapSize
VirtualAlloc
LoadLibraryA
InitializeCriticalSection
GetModuleHandleW
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
ole32
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
setupapi
SetupOpenInfFileW
SetupCloseInfFile
SetupFindFirstLineW
SetupGetStringFieldW
SetupCopyOEMInfW
Sections
.text Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE