dpnsvr.pdb
Behavioral task
behavioral1
Sample
a093070099b508acdace595d5cc8456e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a093070099b508acdace595d5cc8456e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a093070099b508acdace595d5cc8456e_JaffaCakes118
-
Size
166KB
-
MD5
a093070099b508acdace595d5cc8456e
-
SHA1
1c6970585a9f32f87030cbfee732cb2665157234
-
SHA256
7c71dd764b63bf79fcd1929e3db9fc27fc3c522f33084b13b1022b5afcf1ae33
-
SHA512
110347c4fd759ec672bb585bf5a03c349a5c6af1eb4e763d822744b3420dfd507beb9f581b4831af5ffdbb3028fcbdae7928f0275f0450488236b6927c0883d0
-
SSDEEP
3072:2Z1srkv4S1v9BpQOgAZeHr+jr2SH+IXgsbBnjVhcU7FRHRQVEHZ:zc1vFeHr+jqIg4VhcUpR5Z
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a093070099b508acdace595d5cc8456e_JaffaCakes118
Files
-
a093070099b508acdace595d5cc8456e_JaffaCakes118.exe windows:6 windows x86 arch:x86
bc5782c060b0ad1ede76ac7977f77a15
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
SetEvent
DeleteCriticalSection
CreateMutexW
CreateEventW
ReleaseMutex
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
InterlockedDecrement
CreateSemaphoreW
ReleaseSemaphore
GetTickCount
LoadLibraryW
GetProcAddress
FreeLibrary
GetVersionExW
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
LeaveCriticalSection
HeapAlloc
EnterCriticalSection
OpenProcess
GetLastError
CloseHandle
InterlockedIncrement
RegisterApplicationRestart
HeapSetInformation
lstrlenW
CompareStringW
HeapFree
GetProcessHeap
OpenEventW
InterlockedExchange
Sleep
InterlockedCompareExchange
msvcrt
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
memcpy
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
memset
_vsnwprintf
srand
_wcmdln
ole32
CoCreateGuid
CoInitializeEx
CoUninitialize
CoCreateInstance
StringFromGUID2
advapi32
CryptAcquireContextW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
CryptReleaseContext
winmm
timeGetTime
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE