e:\release\RELEASE_1_4_124\hurricane-sw-development\activities\product\GatewayService\Release\LSSrvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bcdc4a7f50634c5f7dbd8fb2ac9a5727_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bcdc4a7f50634c5f7dbd8fb2ac9a5727_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bcdc4a7f50634c5f7dbd8fb2ac9a5727_JaffaCakes118
-
Size
88KB
-
MD5
bcdc4a7f50634c5f7dbd8fb2ac9a5727
-
SHA1
9228d17b57318cf1e977f55525610d3e8f66177f
-
SHA256
67381fd0d31a94344ea3023cfc414ef34ae0ba8f09845839960dc7636ecdf5d7
-
SHA512
d201fb857bc3e99bdcb1059646c78d5bc1f1384ef5d3a35ffde0d55190866f6fd44e41aa68c85e3aad12ec1adead399fdabce0e13aaf4a24fe67d76456d97b54
-
SSDEEP
1536:HYqfoF2MZGYR85zZotOYEPLn8ptvfB82o92l:HYuooEGYy5zZsOYEqvex
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bcdc4a7f50634c5f7dbd8fb2ac9a5727_JaffaCakes118
Files
-
bcdc4a7f50634c5f7dbd8fb2ac9a5727_JaffaCakes118.exe windows:4 windows x86 arch:x86
d71f9430342f22733be695ee05bcf59a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
lssproxy
?error@LoggerWrapper@@QAEXPB_W@Z
??0LoggerWrapper@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?LSNamedPipeFunctionTrace@LoggerWrapper@@QAEXPBD@Z
?error@LoggerWrapper@@QAEXPA_WI@Z
??1LoggerWrapper@@UAE@XZ
shlwapi
StrCpyW
PathAppendW
psapi
GetModuleBaseNameW
EnumProcessModules
kernel32
DisconnectNamedPipe
WaitForSingleObject
FlushFileBuffers
WaitNamedPipeW
CreateThread
ConnectNamedPipe
CreateNamedPipeW
CreateSemaphoreW
InterlockedIncrement
InterlockedDecrement
OutputDebugStringW
DeviceIoControl
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
OpenProcess
CreateDirectoryW
FindClose
FindNextFileW
DeleteFileW
FileTimeToSystemTime
FindFirstFileW
GetSystemTimeAsFileTime
ReleaseSemaphore
GetCurrentProcessId
LocalAlloc
TerminateProcess
InterlockedCompareExchange
CloseHandle
ReadFile
WriteFile
CreateFileW
Sleep
GetLastError
FormatMessageW
LocalFree
GetCurrentDirectoryW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
InitializeCriticalSection
GetCurrentThreadId
InterlockedExchange
user32
wsprintfW
advapi32
SetEntriesInAclA
AllocateAndInitializeSid
GetLengthSid
FreeSid
LookupAccountNameA
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyExW
RegOpenKeyW
RegCreateKeyW
RegSetValueExW
RegCloseKey
ReportEventW
RegOpenKeyExW
RegQueryValueExW
DeregisterEventSource
RegisterEventSourceW
InitializeAcl
shell32
SHGetFolderPathW
msvcp80
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?_Lock@_Mutex@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
?facet_Register@facet@locale@std@@CAXPAV123@@Z
?_Incref@facet@locale@std@@QAEXXZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Id_cnt@id@locale@std@@0HA
??1_Lockit@std@@QAE@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??1locale@std@@QAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
msvcr80
wcsstr
wcsncpy
printf
memset
_snwprintf
??3@YAXPAX@Z
__CxxFrameHandler3
memcpy
free
malloc
??2@YAPAXI@Z
_purecall
??0exception@std@@QAE@ABQBD@Z
_controlfp_s
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
_unlock
_encode_pointer
__dllonexit
_lock
_onexit
_decode_pointer
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
_except_handler4_common
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_CxxThrowException
Sections
.text Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ydogqjx Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE