ucsvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8738686d64aa5b64a3732188dcd20559_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8738686d64aa5b64a3732188dcd20559_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8738686d64aa5b64a3732188dcd20559_JaffaCakes118
-
Size
73KB
-
MD5
8738686d64aa5b64a3732188dcd20559
-
SHA1
88c4598823281315d3a9a7deedcb1ffd373c7a8b
-
SHA256
1ff2e3ce99a4ab793e120d72dd5cb595f72c994f36b01e7a85a20b82f84cbb30
-
SHA512
966258ce5be8acb42cdcea5effe6babb1f5cf8104d0a820b0d68cfaec70caf2a90ee99701e5d0abe9e4bd5ba7cd792214890ccf41dfd27f4e512d398f2d6c1ce
-
SSDEEP
1536:1FbuABfXmoexd+ny1e+I1vYy6SwlDsvRI9:bbD++yWgNDS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8738686d64aa5b64a3732188dcd20559_JaffaCakes118
Files
-
8738686d64aa5b64a3732188dcd20559_JaffaCakes118.exe windows:6 windows x86 arch:x86
a477ccaba259e67759a775acb7c1ee8d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
kernel32
SetLastError
CloseHandle
GetLastError
GetCurrentProcess
LocalFree
VirtualQuery
GetSystemInfo
GetVersionExA
GetStartupInfoW
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
OutputDebugStringA
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExA
InitializeCriticalSection
HeapAlloc
Sleep
VirtualAlloc
HeapReAlloc
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
UnhandledExceptionFilter
TerminateProcess
VirtualProtect
ntdll
NtSetSystemInformation
RtlNtStatusToDosError
RtlUnwind
shell32
CommandLineToArgvW
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 30KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dgdyzxf Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE