whoami.pdb
Behavioral task
behavioral1
Sample
b98e3cbeadc615d67a049944c5249ca7_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b98e3cbeadc615d67a049944c5249ca7_JaffaCakes118
-
Size
150KB
-
MD5
b98e3cbeadc615d67a049944c5249ca7
-
SHA1
3aea1206e7d432285901aa291253205bfce800f3
-
SHA256
ef695c1b9744e391e5fa41055ed4ce74760fa926e6c6d88b74e214ad90090fb8
-
SHA512
55ee31da62ca67d7adc8c971eb0cefa09920e31bed8238d17eadd448759cb40962304efc8533fbdcb4607f4935c5e110d9a61197d97b56c58ff2ed99a2ca36d3
-
SSDEEP
3072:clw+HVQOx6WGnNryvoppqAUnNeBvAvL1D8KXeLXRCErpKcFp:cK8OOx6WGnAAS71D8KIX8ErpKcFp
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b98e3cbeadc615d67a049944c5249ca7_JaffaCakes118
Files
-
b98e3cbeadc615d67a049944c5249ca7_JaffaCakes118.exe windows:6 windows x86 arch:x86
c4a6b9b2a93d476959d6a07969a6ebc6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
LookupPrivilegeNameW
LookupPrivilegeDisplayNameW
CopySid
GetLengthSid
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
LookupAccountSidW
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
GetTokenInformation
kernel32
GetLastError
SetLastError
SetThreadUILanguage
HeapSetInformation
CloseHandle
GetCurrentProcess
FileTimeToSystemTime
GetTimeFormatW
GetModuleFileNameW
ExitProcess
GetConsoleOutputCP
WriteConsoleW
HeapReAlloc
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
HeapValidate
WideCharToMultiByte
CompareStringA
GetThreadLocale
CompareStringW
lstrlenW
GetFileType
GetStdHandle
GetConsoleMode
VerSetConditionMask
VerifyVersionInfoW
FormatMessageW
LocalFree
InterlockedCompareExchange
Sleep
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
InterlockedExchange
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
SetUnhandledExceptionFilter
msvcrt
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
_ultow
_vsnwprintf
__CxxFrameHandler3
_iob
_memicmp
_get_osfhandle
_errno
_fileno
wcstod
wcstoul
wcstol
fflush
fprintf
__iob_func
wcstok
user32
CharUpperW
LoadStringW
CharLowerW
secur32
GetUserNameExW
ws2_32
WSACleanup
shlwapi
StrChrW
StrChrIW
StrStrW
StrStrIW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE