z:\Projects\VS2005\netpass\x64\Release\netpass.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5c8846befc08e672ca2997f443819d07_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5c8846befc08e672ca2997f443819d07_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5c8846befc08e672ca2997f443819d07_JaffaCakes118
-
Size
106KB
-
MD5
5c8846befc08e672ca2997f443819d07
-
SHA1
a4c22d909e72e89b0927d1fc12119bb9f648b111
-
SHA256
1af8e45337900146089a025fb0f0c45a2738841dcbb547a85212d202e550672d
-
SHA512
b5328fb3b5cfd0763266e154170b98a64be18bb8a8c274f2f08521d7d32b107df0b844eb0d0558f5b54195ac7b90c560633dd7798f1c9f88b67b2f29d4e53261
-
SSDEEP
3072:bShnfgnUkRxXQNc7f1H1XHdXGZX2V+k2cWe1Ero:yYh9QEHHw9k5
Malware Config
Signatures
-
Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule sample Nirsoft -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c8846befc08e672ca2997f443819d07_JaffaCakes118
Files
-
5c8846befc08e672ca2997f443819d07_JaffaCakes118.exe windows:4 windows x64 arch:x64
bb9385256b3721a5b35ca756ba7f9e81
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
msvcrt
_initterm
__getmainargs
_acmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_onexit
__dllonexit
_purecall
qsort
_strlwr
strcmp
_memicmp
strchr
strrchr
_strcmpi
__setusermatherr
_commode
_fmode
__set_app_type
malloc
free
strtoul
atoi
_snprintf
wcscpy
wcschr
wcsncmp
memcmp
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
_strnicmp
wcslen
_mbsicmp
_mbscmp
log
strlen
memcpy
abs
strcpy
memset
_itoa
strcat
strncat
sprintf
comctl32
ImageList_AddMasked
ImageList_Create
ord6
CreateToolbarEx
ImageList_SetImageCount
ord17
ImageList_ReplaceIcon
kernel32
GetCurrentProcess
ExitProcess
GetCurrentProcessId
DeleteFileA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
EnumResourceNamesA
WriteFile
CreateRemoteThread
EnumResourceTypesA
SizeofResource
GetStartupInfoA
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
CompareFileTime
FileTimeToLocalFileTime
CloseHandle
GetFileSize
LocalFree
VirtualAllocEx
WriteProcessMemory
ResumeThread
OpenProcess
VirtualFreeEx
ReadProcessMemory
WaitForSingleObject
GetModuleHandleA
GetLastError
LocalAlloc
FileTimeToSystemTime
LoadLibraryExA
FindFirstFileA
GlobalAlloc
LoadResource
GetTempFileNameA
GetFileAttributesA
FindClose
GetVersionExA
GlobalLock
GetTimeFormatA
GetTempPathA
ReadFile
LockResource
GetSystemDirectoryA
FormatMessageA
MultiByteToWideChar
GetModuleFileNameA
CreateFileA
GetWindowsDirectoryA
FindNextFileA
FindResourceA
GetDateFormatA
GlobalUnlock
user32
RegisterWindowMessageA
GetMessageA
DrawTextExA
IsDialogMessageA
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
SetCursor
LoadCursorA
MessageBoxA
DispatchMessageA
EndDialog
GetDlgItem
CreateWindowExA
InvalidateRect
SetDlgItemInt
GetClientRect
SetDlgItemTextA
GetDlgItemTextA
SetWindowTextA
GetSystemMetrics
DeferWindowPos
SendDlgItemMessageA
GetWindowRect
DefWindowProcA
TranslateAcceleratorA
GetWindowPlacement
SendMessageA
RegisterClassA
UpdateWindow
PostMessageA
SetMenu
LoadAcceleratorsA
SetWindowPos
LoadIconA
LoadImageA
GetWindowLongA
SetWindowLongA
SetFocus
SetClipboardData
EnableWindow
EmptyClipboard
MapWindowPoints
EnableMenuItem
ReleaseDC
OpenClipboard
GetClassNameA
CloseClipboard
GetMenuItemCount
GetSubMenu
GetMenuStringA
GetMenu
GetCursorPos
MoveWindow
GetDC
GetSysColor
CheckMenuItem
DestroyMenu
CreateDialogParamA
DestroyWindow
EnumChildWindows
GetMenuItemInfoA
GetWindowTextA
LoadMenuA
GetParent
ModifyMenuA
LoadStringA
DialogBoxParamA
GetDlgCtrlID
EndDeferWindowPos
GetFocus
BeginDeferWindowPos
TrackPopupMenu
PostQuitMessage
TranslateMessage
GetDlgItemInt
gdi32
GetTextExtentPoint32A
SetBkColor
GetStockObject
SelectObject
GetDeviceCaps
SetTextColor
CreateFontIndirectA
SetBkMode
DeleteObject
comdlg32
FindTextA
GetSaveFileNameA
advapi32
CryptDecrypt
CryptCreateHash
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptAcquireContextA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
CryptDeriveKey
shell32
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteA
SHBrowseForFolderA
ole32
CoInitialize
CoUninitialize
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ