s:\NeroHomeSpark\NeroMediaManager\MediaLibrary\src\NMFirstStart\Release Unicode\NMFirstStart.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8b0721f1deb6f05e12bbf8d662cbf5b3_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8b0721f1deb6f05e12bbf8d662cbf5b3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8b0721f1deb6f05e12bbf8d662cbf5b3_JaffaCakes118
-
Size
44KB
-
MD5
8b0721f1deb6f05e12bbf8d662cbf5b3
-
SHA1
72b10aeb8cc55c4e3d758e99e55b3494f8f5b91e
-
SHA256
440216d9d15cafb12a07ab38654c80ad21ac4632a2805a7bc2e106f2b52bfa1d
-
SHA512
760efa6a2c7c703f30d69139a5e45724e446593eedce1d35da77e24084263117ea2c496b44019eba8bbdeea22666bc2642700a80cdfa2a7d42ee0965364bddf9
-
SSDEEP
768:cHK+OVq9GqNwz63CkPU2g3XSeZb/lIMy7qV/LPTkjk:cHKXVc55KHSyRIMy+1o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8b0721f1deb6f05e12bbf8d662cbf5b3_JaffaCakes118
Files
-
8b0721f1deb6f05e12bbf8d662cbf5b3_JaffaCakes118.exe windows:4 windows x86 arch:x86
44eb608cd4ac59c628689ce3f6e97d0a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
CreateProcessW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetStartupInfoW
GetModuleHandleA
ExitProcess
GetVersionExA
user32
DefWindowProcW
CreateWindowExW
RegisterClassW
DestroyWindow
UnregisterClassW
GetMessageW
DispatchMessageW
TranslateMessage
KillTimer
PostQuitMessage
SetTimer
GetWindowLongW
SetWindowLongW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
msvcp71
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
msvcr71
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_amsg_exit
_wcmdln
exit
_cexit
_XcptFilter
_exit
_controlfp
??3@YAXPAX@Z
__CxxFrameHandler
free
_wcsdup
wcscmp
__p___argc
__p___wargv
_except_handler3
_purecall
_vsnwprintf
memset
_c_exit
__security_error_handler
__dllonexit
_onexit
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE