s:\NeroHomeBurst\NeroMediaManager\MediaLibrary\src\NMIndexingService\Release Unicode\NMIndexingService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
70e51a0d146281c84c0ce82c9a076fd6_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
70e51a0d146281c84c0ce82c9a076fd6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
70e51a0d146281c84c0ce82c9a076fd6_JaffaCakes118
-
Size
368KB
-
MD5
70e51a0d146281c84c0ce82c9a076fd6
-
SHA1
576e4cef883715eddd2d7e1a1de57c2e4baf9ddb
-
SHA256
fdadf8b037332f9226927ff9b8bc836127462139e176d76e8807e7b8501a8c04
-
SHA512
8e1d0dc2ff2f072e83a401d2bbfecf5daa8c58ca13877ac8b0f9b7d35d68018119c09272d64ac082aaa4b1e406fae30b03d171071f0dc2145746a1c883170cbe
-
SSDEEP
6144:d9tksv30IFgawvyEFljhZGtRCqYQCQWHIkVdjlcIGoiP0nMFMLl/gHyo:d9tksv30IFkyEFrZGtcyWHfVdNaCFQyo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70e51a0d146281c84c0ce82c9a076fd6_JaffaCakes118
Files
-
70e51a0d146281c84c0ce82c9a076fd6_JaffaCakes118.exe windows:4 windows x86 arch:x86
3d218f2543d3b8d457d2a0238f8352fe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shfolder
SHGetFolderPathW
powrprof
CallNtPowerInformation
kernel32
DeleteCriticalSection
lstrcpyW
RaiseException
EnterCriticalSection
LeaveCriticalSection
lstrcmpiW
GetModuleFileNameW
Sleep
CreateThread
lstrcpynW
lstrcatW
GetCurrentThreadId
FreeLibrary
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
GetFileAttributesW
FreeConsole
SetConsoleTitleW
AllocConsole
CreateDirectoryW
InterlockedCompareExchange
GetCurrentProcess
GetCurrentThread
InitializeCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
GetModuleHandleA
ExitProcess
GetVersionExA
OpenEventW
InterlockedIncrement
QueueUserWorkItem
ReleaseSemaphore
GetSystemTime
SystemTimeToFileTime
WaitForSingleObject
CreateEventW
CreateSemaphoreW
SetEvent
CloseHandle
lstrlenA
MultiByteToWideChar
GetTickCount
lstrlenW
WideCharToMultiByte
GetLastError
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
WaitForMultipleObjects
InterlockedDecrement
GetExitCodeThread
GetCommandLineW
LocalFree
AddAtomW
FindAtomW
DeleteAtom
user32
DefWindowProcW
CharNextW
TranslateMessage
DispatchMessageW
UnregisterClassW
MessageBoxW
CharUpperW
LoadStringW
PostThreadMessageW
GetMessageW
GetWindowLongW
SetWindowLongW
DestroyWindow
RegisterClassW
CreateWindowExW
advapi32
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
RegDisablePredefinedCache
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
RegEnumKeyExW
ControlService
DeleteService
CreateServiceW
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetServiceStatus
OpenThreadToken
shell32
SHGetSpecialFolderPathW
ole32
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoDisconnectObject
CoInitializeSecurity
CoSuspendClassObjects
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemRealloc
StringFromGUID2
CoResumeClassObjects
CoImpersonateClient
CoInitializeEx
oleaut32
SysStringLen
SysAllocStringLen
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SysAllocString
ws2_32
inet_addr
shlwapi
UrlCreateFromPathW
UrlCanonicalizeW
UrlIsW
PathCreateFromUrlW
PathIsUNCW
PathIsURLW
PathAppendW
PathFindExtensionW
SHRegCloseUSKey
SHRegCreateUSKeyW
SHRegWriteUSValueW
SHRegQueryUSValueW
msvcp71
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Nomemory@std@@YAXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?classic@locale@std@@SAABV12@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??_7?$codecvt@GDH@std@@6B@
??_7codecvt_base@std@@6B@
??_7facet@locale@std@@6B@
??0_Locimp@locale@std@@AAE@ABV012@@Z
?id@?$codecvt@GDH@std@@2V0locale@2@A
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_Getcat@?$codecvt@GDH@std@@SAIPAPBVfacet@locale@2@@Z
?imbue@?$basic_ios@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??0?$codecvt@GDH@std@@QAE@I@Z
?do_always_noconv@?$codecvt@GDH@std@@MBE_NXZ
?do_unshift@?$codecvt@GDH@std@@MBEHAAHPAD1AAPAD@Z
?do_length@?$codecvt@GDH@std@@MBEHABHPBD1I@Z
?write@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@PBGH@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Id_cnt@id@locale@std@@0HA
?_Xran@_String_base@std@@QBEXXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@J@Z
?fail@ios_base@std@@QBE_NXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
?clear@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_N@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??_D?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?str@?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?good@ios_base@std@@QBE_NXZ
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?width@ios_base@std@@QAEHH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?width@ios_base@std@@QBEHXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1locale@std@@QAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?to_int_type@?$char_traits@D@std@@SAHABD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flags@ios_base@std@@QBEHXZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
msvcr71
_wcsnicmp
isspace
tolower
isalpha
isalnum
strncmp
strchr
_snprintf
fprintf
sscanf
fputs
?before@type_info@@QBEHABV1@@Z
isdigit
_itow
wcscpy
_beginthreadex
_wcsicmp
memset
_callnewh
__security_error_handler
??1type_info@@UAE@XZ
__dllonexit
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
_amsg_exit
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_wcsdup
_CxxThrowException
??0exception@@QAE@XZ
__CxxFrameHandler
??3@YAXPAX@Z
??1exception@@UAE@XZ
free
??0exception@@QAE@ABV0@@Z
malloc
??8type_info@@QBEHABV0@@Z
_ltoa
wcstok
atol
atoi
_purecall
_vsnwprintf
_wsplitpath
_vscwprintf
_except_handler3
_putws
vswprintf
??_V@YAXPAX@Z
wcsncpy
realloc
freopen
_iob
wcscmp
memmove
wcslen
Exports
Exports
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@UUriSelectionInfo@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@V?$set@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UCaseInsensitiveLess@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UUriSelectionInfo@@V?$allocator@UUriSelectionInfo@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@VCUriSelectionAndFilterConfig@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
Sections
.text Size: 184KB - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE