g:\Acro_root_ns\BuildResults\bin\Release\AdobeCollabSync.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8b8d6c6000aa0e993bfa3ed9b8dfe41a_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8b8d6c6000aa0e993bfa3ed9b8dfe41a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8b8d6c6000aa0e993bfa3ed9b8dfe41a_JaffaCakes118
-
Size
529KB
-
MD5
8b8d6c6000aa0e993bfa3ed9b8dfe41a
-
SHA1
e11752a40644c998d5b04afe31809840738f067a
-
SHA256
1cf0a2df1c9cd41736cb9b4e5f91f7749d61caf54ab2844a79628d3e17d3e6d1
-
SHA512
6945a68ff2f55d82ad892f7035e613e5077b8af71cb5e6055cf3c18243af284966b5ca668d860016fa098e1ce10ff6ad69581788f295571ad6e534a3b679f351
-
SSDEEP
12288:oc9iJafmm2VYK+UNo0RweQfoAxHv9sN4A4H9Jk18UtQ43iU9:MVm2VZQwy9q1Vf3f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8b8d6c6000aa0e993bfa3ed9b8dfe41a_JaffaCakes118
Files
-
8b8d6c6000aa0e993bfa3ed9b8dfe41a_JaffaCakes118.exe windows:4 windows x86 arch:x86
a1f0048b758425c33990f38885490d83
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
StrCmpNA
axe8sharedexpat
ord2
ord1
ord3
bib
ord11
ord4
kernel32
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
FlushFileBuffers
GetCurrentProcessId
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
FreeLibrary
InterlockedCompareExchange
InterlockedExchange
GetCurrentThread
GetCurrentProcess
RemoveDirectoryW
CreateDirectoryW
FindNextFileW
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
GetOverlappedResult
PeekNamedPipe
FindNextChangeNotification
ResetEvent
FindFirstChangeNotificationW
LocalAlloc
LocalFree
lstrlenA
GetSystemDirectoryA
lstrcatA
FindCloseChangeNotification
GetVersionExA
LoadLibraryA
CreateEventA
WaitForMultipleObjects
WaitForSingleObject
CloseHandle
SetEvent
GetLastError
GetModuleFileNameW
GetUserDefaultLCID
DeleteCriticalSection
GetStartupInfoA
TlsFree
TlsGetValue
InitializeCriticalSection
TlsAlloc
CreateSemaphoreA
TlsSetValue
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
CreateThread
SwitchToThread
Sleep
GetSystemTimeAsFileTime
GetLocalTime
GetDriveTypeW
DeleteFileW
MoveFileW
SetFilePointer
FindClose
GetFullPathNameW
FindFirstFileW
GetFileInformationByHandle
SetEndOfFile
WriteFile
ReadFile
sensapi
IsNetworkAlive
sqlite
sqlite3_errcode
sqlite3_close
sqlite3_errmsg
sqlite3_result_error
sqlite3_value_int
sqlite3_bind_text
sqlite3_prepare_v2
sqlite3_get_autocommit
sqlite3_exec
sqlite3_free
sqlite3_step
sqlite3_changes
sqlite3_column_type
sqlite3_bind_null
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int64
sqlite3_bind_int
sqlite3_value_type
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_double
sqlite3_column_text
sqlite3_open_v2
sqlite3_busy_handler
sqlite3_create_function
sqlite3_bind_parameter_count
sqlite3_reset
sqlite3_last_insert_rowid
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_finalize
sqlite3_result_value
msvcp80
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Xran@_String_base@std@@SAXXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
msvcr80
_crt_debugger_hook
_except_handler4_common
_invoke_watson
??0exception@std@@QAE@ABV01@@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBDH@Z
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_mktime64
_vsnwprintf_s
swscanf_s
iswalpha
_wcslwr_s
free
malloc
_CIpow
toupper
sscanf
sprintf
_strlwr
atoi
memmove_s
wcsrchr
_wcsicmp
wcscat_s
??2@YAPAXI@Z
_invalid_parameter_noinfo
__CxxFrameHandler3
??0exception@std@@QAE@ABQBD@Z
strchr
memset
memcpy
_CxxThrowException
_purecall
_controlfp_s
ws2_32
WSAIoctl
WSACreateEvent
WSAEventSelect
WSAGetLastError
WSACleanup
WSASocketA
WSAStartup
wininet
HttpEndRequestA
HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
HttpQueryInfoA
InternetOpenA
HttpAddRequestHeadersA
HttpSendRequestA
InternetSetOptionA
HttpSendRequestExA
InternetReadFile
InternetWriteFile
InternetCloseHandle
mpr
WNetCancelConnection2A
WNetAddConnection2A
crypt32
CryptProtectData
CryptUnprotectData
user32
CreateWindowExW
CreatePopupMenu
GetMessageA
DestroyMenu
RegisterClassW
DispatchMessageA
GetSystemMetrics
PostMessageA
PostQuitMessage
TranslateMessage
GetCursorPos
InsertMenuW
TrackPopupMenu
LoadImageW
DestroyWindow
CallWindowProcA
SetPropW
LoadStringW
DefWindowProcA
SetForegroundWindow
InsertMenuItemW
GetPropW
advapi32
RegOpenKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertSidToStringSidA
OpenProcessToken
GetTokenInformation
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
OpenThreadToken
RegCloseKey
shell32
Shell_NotifyIconW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteA
ole32
CoTaskMemFree
CoCreateInstance
oleaut32
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
Sections
.text Size: 368KB - Virtual size: 365KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE