c:\repo2\firewall\trunk\bin\Win32\Release\signcheck.pdb
Behavioral task
behavioral1
Sample
85810977c64139ba0d2d9ee4f87afa20_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
85810977c64139ba0d2d9ee4f87afa20_JaffaCakes118
-
Size
152KB
-
MD5
85810977c64139ba0d2d9ee4f87afa20
-
SHA1
0b33e667992986b27f6d40c5d6cb138d77db56bd
-
SHA256
4d172ad7766601f8dadb3f7137974171b858172970745535d724678e7015cd66
-
SHA512
40fc21dbb3078a777905230562d4a71f25d8cc76e15dcc8185d16e8ce95e01fb58f1e5b1f48eba6653225ca1c9c627e181b23776b61a2d61045c41bcdb8b00e6
-
SSDEEP
3072:C24v0oiRxMfWs9brxkMZQexZ6JANptLaaNoGF0+C4xTCk6T:f62sH9brexexZ6JuLaa19TCxT
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85810977c64139ba0d2d9ee4f87afa20_JaffaCakes118
Files
-
85810977c64139ba0d2d9ee4f87afa20_JaffaCakes118.exe windows:5 windows x86 arch:x86
6cde249be07466d1fa882779a8770856
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
wintrust
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseContext
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
WinVerifyTrust
CryptCATAdminAcquireContext
kernel32
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
GetCommandLineW
LocalFree
CreateFileW
GetLastError
CloseHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
TerminateProcess
shell32
CommandLineToArgvW
msvcr90
_exit
_XcptFilter
exit
_wcmdln
_cexit
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
memset
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
__wgetmainargs
_amsg_exit
??2@YAPAXI@Z
??3@YAXPAX@Z
_initterm
__p__commode
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE