fltMC.pdb
Behavioral task
behavioral1
Sample
643d05d39913b21a0b8bcff43cee9c9a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
643d05d39913b21a0b8bcff43cee9c9a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
643d05d39913b21a0b8bcff43cee9c9a_JaffaCakes118
-
Size
162KB
-
MD5
643d05d39913b21a0b8bcff43cee9c9a
-
SHA1
cc172c0a04f21709457f5f253857b552b8ca4124
-
SHA256
942e49a9b8ddd301243c15b10d68a45f04a3bb2a4c3636a890ab007610fac065
-
SHA512
78b9e40acf1c195d80be365d8e0bfd36b637c45076ef5baee0bb396c2c2bbec7afe03f1af13d9dc611c8e9c462d723f3f6a262f987f0f897d0c73e042cb8dadc
-
SSDEEP
3072:mFIrZePbp2R+lEGVqBayszzaL8E13MswO9mpJoe7XMk3nngVBy:uTp2R+lE8qYys9E133wG7erMkXgi
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 643d05d39913b21a0b8bcff43cee9c9a_JaffaCakes118
Files
-
643d05d39913b21a0b8bcff43cee9c9a_JaffaCakes118.exe windows:6 windows x86 arch:x86
38c7c81c01a63d9744b8172ca8f42968
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
OpenProcessToken
AdjustTokenPrivileges
kernel32
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
TerminateProcess
SetThreadPreferredUILanguages
GetStdHandle
HeapSetInformation
FormatMessageW
UnhandledExceptionFilter
GetLastError
WriteConsoleW
LocalAlloc
WideCharToMultiByte
WriteFile
LocalFree
GetFileType
GetConsoleMode
GetCurrentProcess
CloseHandle
GetModuleHandleA
msvcrt
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
memcpy
malloc
free
_wcsicmp
_vsnwprintf
_controlfp
fltlib
FilterFindNext
FilterFindClose
FilterUnload
FilterLoad
FilterGetDosName
FilterInstanceFindClose
FilterInstanceFindNext
FilterInstanceFindFirst
FilterVolumeInstanceFindNext
FilterVolumeInstanceFindFirst
FilterVolumeFindClose
FilterVolumeFindNext
FilterVolumeFindFirst
FilterAttach
FilterAttachAtAltitude
FilterDetach
FilterFindFirst
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 882B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE