rdrleakdiag.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a9ee9be5c3a40efbbe6a2b512923ff6f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a9ee9be5c3a40efbbe6a2b512923ff6f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a9ee9be5c3a40efbbe6a2b512923ff6f_JaffaCakes118
-
Size
179KB
-
MD5
a9ee9be5c3a40efbbe6a2b512923ff6f
-
SHA1
70eb9cd6d0ee6069207572d98db93f6b775067f0
-
SHA256
0ce0e883ee8f7fb9008929bba1a41da2ca2a301203947bd004a860c4dd5d2cf1
-
SHA512
d95b42abbcec0188b31630d0774b26256fe9f4ea5c725535b1055eb7ff73be7611bfb92c05f32d892acc0c394b63e7ecae8abfbefc84c3b41ef97390f6449de4
-
SSDEEP
3072:h8qNnauIO7BnpoMyEmXNKHwEXeA44TfiQwNnXgqAfZYjZ+adnYAgcUjcLbGdAB:5auRQKHwwuXgqAarYAgcUcRB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a9ee9be5c3a40efbbe6a2b512923ff6f_JaffaCakes118
Files
-
a9ee9be5c3a40efbbe6a2b512923ff6f_JaffaCakes118.exe windows:6 windows x86 arch:x86
a4ef62bd2c2df3ac401c7010c2cfa347
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
EventWrite
EnumServicesStatusExW
OpenSCManagerW
QueryServiceConfigW
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenServiceW
kernel32
IsWow64Process
ReadProcessMemory
UnmapViewOfFile
CloseHandle
CreateFileW
HeapFree
GetVersionExW
HeapAlloc
GetProcessHeap
GetLastError
GetModuleHandleW
K32GetModuleFileNameExW
MapViewOfFile
CreateFileMappingW
WaitForMultipleObjects
GetCurrentProcess
WaitForSingleObject
SetProcessShutdownParameters
SetConsoleCtrlHandler
GetProcessTimes
CreateDirectoryW
DeleteFileW
GetTempFileNameW
GetTempPathW
HeapSetInformation
LoadLibraryW
GetProcAddress
FreeLibrary
GetSystemTimeAsFileTime
SetFilePointer
GetProcessId
GetModuleFileNameW
LocalAlloc
LocalFree
SetLastError
OpenProcess
UnhandledExceptionFilter
TerminateProcess
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
WriteFile
GetCurrentProcessId
RemoveDirectoryW
user32
LoadStringW
msvcrt
_wtol
_wcsicmp
memcpy
memset
qsort
wcsrchr
__wgetmainargs
_cexit
_exit
_XcptFilter
_vsnwprintf
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
exit
ntdll
RtlReleaseSRWLockExclusive
NtSetEvent
RtlAcquireSRWLockExclusive
RtlAllocateHeap
NtClose
NtQueryInformationThread
NtWaitForSingleObject
EtwEventUnregister
EtwEventRegister
RtlNtStatusToDosError
NtCreateMutant
NtResetEvent
NtCreateEvent
RtlCreateProcessReflection
NtReleaseMutant
NtQueryInformationProcess
NtDuplicateObject
NtOpenProcess
NtCreateThreadEx
RtlInitUnicodeString
RtlEqualUnicodeString
RtlFreeHeap
wer
WerReportAddFile
WerReportSetParameter
WerReportCreate
WerReportSubmit
WerReportCloseHandle
shlwapi
ord348
dbghelp
MiniDumpWriteDump
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PACK Size: 144KB - Virtual size: 380KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE