s:\NeroHome102x\NeroMediaManager\MediaLibrary\src\NMIndexStoreSvr\Release Unicode\NMIndexStoreSvr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
87b1726171d9946348dc84b8173fc260_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
87b1726171d9946348dc84b8173fc260_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
87b1726171d9946348dc84b8173fc260_JaffaCakes118
-
Size
536KB
-
MD5
87b1726171d9946348dc84b8173fc260
-
SHA1
c74fb35fdf5e146c381633a569019d385883567b
-
SHA256
b17090c6ad5a836a31e651b08a455cb922c56cbeebe423646eadc56fb0fa70b5
-
SHA512
26c2ff822c93ca5dcc04c2c58d81ad83a593d36c07753c0f756ccbe76588cb1127b717dc5900f3241d70105321423f3f4ea7f32d1f7d3f88339df97bc9059337
-
SSDEEP
12288:TfXYi+JNvEyGcEgh/wn/SsKgrXqOulB95aXrLM8PrLtuSZVc66YyNoRXlNSWENDa:zv+bAgoYePgxDCh89JOp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 87b1726171d9946348dc84b8173fc260_JaffaCakes118
Files
-
87b1726171d9946348dc84b8173fc260_JaffaCakes118.exe windows:4 windows x86 arch:x86
02ae26d5752b5f8041b430afaa996c33
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
rpcrt4
UuidCreate
shfolder
SHGetFolderPathW
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA
kernel32
GetSystemTime
WaitForSingleObject
SetEvent
CloseHandle
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
GetCurrentThreadId
GetLastError
WideCharToMultiByte
Sleep
GetTickCount
WaitForMultipleObjects
CreateEventW
lstrcpynW
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
lstrcpyW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiW
MultiByteToWideChar
lstrlenA
GetFileAttributesW
SystemTimeToFileTime
SizeofResource
LoadResource
FindResourceW
GetExitCodeThread
GetModuleHandleW
GetModuleFileNameW
ResetEvent
SetThreadPriority
SetThreadPriorityBoost
GetCurrentThread
CreateProcessW
CreateThread
lstrcatW
GetCommandLineW
FreeConsole
SetConsoleTitleW
AllocConsole
GetCurrentProcessId
GetProcAddress
CreateDirectoryW
TlsFree
GetSystemTimeAsFileTime
FormatMessageW
LocalAlloc
LocalFree
TlsGetValue
TlsSetValue
TlsAlloc
ReleaseMutex
CreateMutexA
GetVersionExA
GetShortPathNameW
lstrlenW
LoadLibraryA
ExitProcess
GetStartupInfoW
QueryPerformanceCounter
FileTimeToSystemTime
FreeLibrary
LoadLibraryExW
GetModuleHandleA
FindNextFileW
FindFirstFileW
FindClose
user32
RegisterWindowMessageW
wsprintfW
MessageBoxA
PostMessageW
CharNextW
TranslateMessage
DispatchMessageW
GetMessageW
MessageBoxW
CharUpperW
PostThreadMessageW
advapi32
RegQueryInfoKeyW
RegOpenKeyExA
RegQueryValueExA
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
shell32
SHGetSpecialFolderPathW
ole32
CoTaskMemAlloc
CoInitializeEx
CoUninitialize
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoRevokeClassObject
CoRegisterClassObject
StringFromGUID2
StringFromCLSID
CoResumeClassObjects
CoDisconnectObject
CoCreateGuid
CoSuspendClassObjects
oleaut32
VarBstrCmp
GetErrorInfo
VariantCopyInd
SafeArrayCreate
SafeArrayRedim
SafeArrayDestroy
SafeArrayLock
SafeArrayUnlock
SafeArrayCopy
SafeArrayGetVartype
SafeArrayGetLBound
SafeArrayGetUBound
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
VarUI4FromStr
VariantClear
VariantInit
SysAllocStringLen
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysAllocString
VarBstrCat
nmsqldb
sqlite3_column_int
sqlite3_errmsg16
sqlite3_finalize
sqlite3_close
sqlite3_prepare
sqlite3_prepare16
sqlite3_errmsg
sqlite3_exec
sqlite3_open
sqlite3_column_text16
sqlite3_registerCaseFoldingCollations
sqlite3_column_int64
sqlite3_bind_double
sqlite3_value_text16
sqlite3_result_int64
sqlite3_value_double
sqlite3_value_int64
sqlite3_value_type
sqlite3_create_function16
sqlite3_last_insert_rowid
sqlite3_bind_null
sqlite3_bind_int
sqlite3_column_double
sqlite3_column_type
sqlite3_bind_text16
sqlite3_reset
sqlite3_step
sqlite3_bind_int64
shlwapi
PathIsRootW
PathIsPrefixW
PathAppendW
PathAddBackslashW
PathIsUNCW
PathCreateFromUrlW
UrlIsW
UrlCanonicalizeW
UrlCreateFromPathW
PathIsURLW
PathRemoveFileSpecW
SHRegCloseUSKey
SHRegCreateUSKeyW
SHRegWriteUSValueW
SHRegQueryUSValueW
PathFindExtensionW
UrlCombineW
msvcp71
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Xran@_String_base@std@@QBEXXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?flags@ios_base@std@@QBEHXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?to_int_type@?$char_traits@D@std@@SAHABD@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?width@ios_base@std@@QBEHXZ
?eof@?$char_traits@D@std@@SAHXZ
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?width@ios_base@std@@QAEHH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?uncaught_exception@std@@YA_NXZ
?_Nomemory@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??$?9GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AViterator@12@V312@@Z
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AViterator@12@XZ
?at@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?good@ios_base@std@@QBE_NXZ
msvcr71
_wcslwr
_purecall
??3@YAXPAX@Z
__CxxFrameHandler
free
_CxxThrowException
malloc
_i64tow
_vsnwprintf
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_beginthreadex
_wtol
memmove
wcslen
wcscmp
??_V@YAXPAX@Z
_except_handler3
_wcsnicmp
_wsplitpath
_wcsdup
realloc
_vsnprintf
wcsncpy
freopen
_iob
_vscwprintf
wcstod
_wcstoi64
wcsrchr
_ltow
isspace
tolower
isalpha
isalnum
strncmp
strchr
strncpy
sprintf
fgets
fclose
ftell
fseek
fopen
fprintf
sscanf
atoi
fputs
?what@exception@@UBEPBDXZ
??8type_info@@QBEHABV0@@Z
isdigit
_itow
wcscpy
swscanf
memset
_callnewh
__security_error_handler
??1type_info@@UAE@XZ
__dllonexit
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
_amsg_exit
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_wcsicmp
??1exception@@UAE@XZ
Sections
.text Size: 404KB - Virtual size: 402KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 92KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE