f:\Project\HDMI\RtkAudioService\RtkAudioService\x64\release\RtkAudioService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6320a7c51edfd7e47d73e0a67c06da6b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6320a7c51edfd7e47d73e0a67c06da6b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6320a7c51edfd7e47d73e0a67c06da6b_JaffaCakes118
-
Size
165KB
-
MD5
6320a7c51edfd7e47d73e0a67c06da6b
-
SHA1
eb2269b2c3d7742a75c7b3a444f4d4b826eb781c
-
SHA256
0360549c8a71f1419aa850aefd048af045f8ba5ab60738581d3daedae2767158
-
SHA512
db34851b7f6e3cd6bd00928d1184f290b7a2c8e5d46830c8e033e3386a74dd0a39c569cd519a4cab64da53c696a19da199c43d669c9d018430823a4c880ae0ae
-
SSDEEP
3072:xwat9AEAEftxh0q2aTi4SbuP7RMNTw/qiqc1IQ5seHuOAh4derbdtM:xweAE/ftBRWxbkMNAJAeHuORde
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6320a7c51edfd7e47d73e0a67c06da6b_JaffaCakes118
Files
-
6320a7c51edfd7e47d73e0a67c06da6b_JaffaCakes118.exe windows:4 windows x64 arch:x64
80ad50a20d7ce0e7ac4c1302701a5917
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
setupapi
SetupDiGetDeviceRegistryPropertyW
CM_Get_Device_IDW
CM_Get_Parent
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
CM_Free_Res_Des_Handle
CM_Get_Res_Des_Data
CM_Get_Res_Des_Data_Size
CM_Get_Next_Res_Des
CM_Get_First_Log_Conf
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
kernel32
GetConsoleCP
SetFilePointer
GetLocaleInfoA
FindResourceW
CreateFileW
DeviceIoControl
GetLastError
SizeofResource
CloseHandle
LockResource
LoadResource
GetConsoleMode
RaiseException
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForMultipleObjects
InitializeCriticalSection
LocalAlloc
DeleteCriticalSection
LocalFree
SetWaitableTimer
CreateEventW
CreateWaitableTimerW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FindResourceExW
GetProcAddress
FlushFileBuffers
CreateFileA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetVersionExA
RtlUnwindEx
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
HeapCreate
GetStringTypeW
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RtlPcToFileHeader
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
MultiByteToWideChar
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
LoadLibraryA
GetStringTypeA
WriteConsoleW
user32
RegisterDeviceNotificationW
UnregisterDeviceNotification
UnregisterClassA
advapi32
SetServiceStatus
StartServiceCtrlDispatcherW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegisterServiceCtrlHandlerExW
ole32
StringFromGUID2
Sections
.text Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 44KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE