msiloadr.pdb
Behavioral task
behavioral1
Sample
c7ef6b524c2ff3dddf6eb3b8c1206847_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
c7ef6b524c2ff3dddf6eb3b8c1206847_JaffaCakes118
-
Size
252KB
-
MD5
c7ef6b524c2ff3dddf6eb3b8c1206847
-
SHA1
0e6eb8eeee613a0f038fc8d7f4486134b8485bec
-
SHA256
2e5b3a14421c690a4bc7cea8ab69e2b868d323636f4a7a2b32f603c5d2b8587b
-
SHA512
1f489c8905e4c45661e759b3ad84c7bc46a38fb44f1aa68034de2a4292f7683dce0bf4125c44f7594e9b5a3b901b17717b62c95412715f490a7f9364d64468be
-
SSDEEP
3072:69IoYcvEMJGo5LOtJasl9c6QIyNtGmo5ZwHJy94Lbv916t5LahrwcWT5QWhhQDeL:AMo5qyCcBIyNGXIJh3phwcyFhQDH0
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c7ef6b524c2ff3dddf6eb3b8c1206847_JaffaCakes118
Files
-
c7ef6b524c2ff3dddf6eb3b8c1206847_JaffaCakes118.exe windows:4 windows x86 arch:x86
16565ac95a428f6ccd17d07d629c1a8c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
oleaut32
VarUI4FromStr
SysAllocStringLen
GetErrorInfo
SetErrorInfo
SysAllocString
SysFreeString
ole32
OleRun
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
kernel32
lstrcmpA
CloseHandle
CreateFileA
Sleep
SetLastError
GetTickCount
GetPrivateProfileStringA
GetModuleFileNameA
GetExitCodeProcess
CreateProcessA
FreeLibrary
LoadLibraryA
GetSystemDirectoryA
WideCharToMultiByte
lstrlenW
IsBadReadPtr
GetProcAddress
WriteFile
ReadFile
DeleteFileW
SetErrorMode
LoadLibraryExA
MultiByteToWideChar
LoadResource
SizeofResource
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
GetModuleHandleA
FindResourceA
GetUserDefaultLCID
GetEnvironmentVariableA
GetVersion
CreateFileW
FindResourceW
GlobalAlloc
GetModuleFileNameW
GetTempFileNameW
GetTempPathW
LoadLibraryExW
GetLocaleInfoA
InterlockedExchange
LocalFree
GetTempFileNameA
GetTempPathA
GlobalFree
CreateMutexA
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExA
GetThreadLocale
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetUnhandledExceptionFilter
GetCPInfo
GetOEMCP
HeapSize
IsBadWritePtr
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
TlsAlloc
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
GetCurrentProcess
TerminateProcess
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapAlloc
RtlUnwind
HeapFree
ExitProcess
GetCommandLineA
GetStartupInfoA
GetACP
FlushFileBuffers
SetFilePointer
IsBadCodePtr
user32
LoadStringA
MessageBoxA
MsgWaitForMultipleObjects
PeekMessageA
TranslateMessage
DispatchMessageA
CharNextA
shell32
ShellExecuteA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
QueryServiceStatus
ControlService
OpenServiceA
OpenSCManagerA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
Sections
.text Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE