sdbinst.pdb
Behavioral task
behavioral1
Sample
88dd3987569a367057cee9b4c3c443b8_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
88dd3987569a367057cee9b4c3c443b8_JaffaCakes118
-
Size
164KB
-
MD5
88dd3987569a367057cee9b4c3c443b8
-
SHA1
c537498e40ce4262388f6cffb9adeac97a38631a
-
SHA256
c294188d85ef62638bfae36ea75abd2ca1b93ad2f56dd021dd6e336191eddbaa
-
SHA512
04ab3ea42245673bcf082d9b64967d06ad868a57d4e2544fc3f3e2ca48c58e4d6231eb4349a4b6399af870f38e9f98c2895df3558cf2dab8ba375f758d896281
-
SSDEEP
3072:UxXRj18nXwMfqL7uqmB/fkEJHPVo5aWSSaJM1GyyUpvnCoV1Cz4hKgFLg0Sxn:Un1vVqt1ZJ25a7JrydJVrXLi
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 88dd3987569a367057cee9b4c3c443b8_JaffaCakes118
Files
-
88dd3987569a367057cee9b4c3c443b8_JaffaCakes118.exe windows:6 windows x86 arch:x86
87cbeae39ada9e96c7f27b94962cd83f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyExW
kernel32
GetSystemWindowsDirectoryW
GetConsoleMode
GetFileType
LocalFree
WriteFile
WideCharToMultiByte
LocalAlloc
WriteConsoleW
GetStdHandle
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
GetFileAttributesW
FindNextFileW
FindClose
FindFirstFileW
DeleteFileW
SetFileAttributesW
CopyFileW
GetLastError
CreateDirectoryW
GetSystemTimeAsFileTime
GetModuleHandleW
HeapSetInformation
SetThreadPreferredUILanguages
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter
msvcrt
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
_cexit
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_vsnwprintf
fgetwc
_iob
memset
__wgetmainargs
tolower
_wfullpath
towupper
memcpy
_wcsicmp
wcsrchr
_exit
apphelp
SdbReadDWORDTag
SdbIsStandardDatabase
SdbRegisterDatabaseEx
SdbGetBinaryTagData
SdbFindNextTag
SdbOpenDatabase
SdbReadBinaryTag
SdbCloseDatabase
SdbFindFirstTag
SdbGetStringTagPtr
SdbUnregisterDatabase
user32
LoadStringW
shell32
ord680
ntdll
RtlFreeUnicodeString
NtDeleteKey
RtlStringFromGUID
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 790B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE