vmbuspipe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5da94ff425bc1d8decb31d488d1b2366_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5da94ff425bc1d8decb31d488d1b2366_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5da94ff425bc1d8decb31d488d1b2366_JaffaCakes118
-
Size
70KB
-
MD5
5da94ff425bc1d8decb31d488d1b2366
-
SHA1
d37ae162ff3d3d5b270900d34d7da67412656bb6
-
SHA256
6c840f082e17fd474906c2ab08ce2698c5320530c526c33b6d93e76f06836f65
-
SHA512
f481e45fab9c5d1eba2d7e1fe296d690ef469a6c81c9d03a28b63fcfd02ce3a90d045e02428935085cacdc0fc0bd007eee2adabf5568b610f7d8303d059cd802
-
SSDEEP
1536:AyBRW+ysHG8MPTp0xJ2MryjQZRmlAY20HoH:7osHzxPyjQDMAEIH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5da94ff425bc1d8decb31d488d1b2366_JaffaCakes118
Files
-
5da94ff425bc1d8decb31d488d1b2366_JaffaCakes118.dll windows:6 windows x86 arch:x86
f87a65544fff30aa3b99a11bbfeb1538
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
wcsncmp
memset
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
ntdll
RtlUnwind
setupapi
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDevRegKey
SetupDiGetDeviceInstanceIdW
SetupDiDestroyDeviceInfoList
advapi32
RegQueryValueExW
RegCloseKey
kernel32
GetModuleHandleW
GetProcessHeap
InterlockedExchange
CloseHandle
GetOverlappedResult
GetLastError
DeviceIoControl
CreateEventW
CreateFileW
SetLastError
HeapFree
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
HeapAlloc
ole32
IIDFromString
user32
SetWindowLongW
DestroyWindow
KillTimer
DefWindowProcW
PostMessageW
GetWindowLongW
RegisterDeviceNotificationW
UnregisterClassW
UnregisterDeviceNotification
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
GetDesktopWindow
RegisterClassExW
SetTimer
Exports
Exports
VmbusPipeClientEnumeratePipes
VmbusPipeClientOpenChannel
VmbusPipeClientWaitChannel
VmbusPipeGetPipeMode
VmbusPipeServerConnectPipe
VmbusPipeServerOfferChannel
VmbusPipeServerPause
VmbusPipeServerResume
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ