WMIC.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dc41e29d4ffac908aee413bc736928ab_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dc41e29d4ffac908aee413bc736928ab_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dc41e29d4ffac908aee413bc736928ab_JaffaCakes118
-
Size
497KB
-
MD5
dc41e29d4ffac908aee413bc736928ab
-
SHA1
66c46394c4cef21e4926854549fe7f0ad15b51e9
-
SHA256
f8d7bc4c13611e2478e2ff07f01398d6abebe913b28afb3a8636792462c812e9
-
SHA512
df768cf8505bd796c641cec11913f9692fe3fa3e6f12e35b6dc72b6d724ef06835c0b3115c6e38592974d39abcf6cd0bdf6f0e06951bbb7adc5489ba4b6857cf
-
SSDEEP
6144:ssxm+QHH9FSgaEx18L3X4BuLHlNdpSKMViLDYwVPBXxxTsAG9SjVsO7BnE5GRryo:ssw+QH+gR0LFx0Ki0mQnSGRW8+CZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc41e29d4ffac908aee413bc736928ab_JaffaCakes118
Files
-
dc41e29d4ffac908aee413bc736928ab_JaffaCakes118.exe windows:5 windows x86 arch:x86
9568be97a635354a409e5b38875082fa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
?terminate@@YAXXZ
_controlfp
??2@YAPAXI@Z
__CxxFrameHandler
swprintf
_ltow
_CxxThrowException
_wcsicmp
wcstok
??1type_info@@UAE@XZ
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
_wfreopen
_wtoi64
_i64tow
_kbhit
_filelength
_wremove
fputws
fprintf
fflush
fwprintf
wcsncpy
wcsncmp
fread
fseek
towlower
swscanf
wctomb
wcsstr
fgets
wcscmp
wcstoul
_wfopen
fwrite
fclose
_ftol
_getch
ceil
_wsystem
_wtoi
_itow
wcslen
??0exception@@QAE@ABV0@@Z
_iob
fgetws
sprintf
_wcsnicmp
wcscpy
_wtol
??3@YAXPAX@Z
msvcp60
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIPBG@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?data@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??0logic_error@std@@QAE@ABV01@@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
advapi32
RegCloseKey
RegOpenKeyExW
GetTokenInformation
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
kernel32
CompareFileTime
CreateEventW
CreateThread
SetEvent
WaitForSingleObject
DeleteFileW
GetCommandLineW
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
LocalAlloc
LoadLibraryW
FreeLibrary
GetProcAddress
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentProcess
SetConsoleScreenBufferSize
GetConsoleMode
SetConsoleMode
ReadConsoleW
SetConsoleCursorPosition
WriteConsoleW
WideCharToMultiByte
GetFileTime
MultiByteToWideChar
GetComputerNameW
GetSystemDefaultUILanguage
GetConsoleScreenBufferInfo
FormatMessageW
GetStdHandle
GetFileType
lstrcatW
GetLocalTime
GetFileSizeEx
GetLastError
WriteFile
CreateFileW
SetFilePointer
SetLastError
CloseHandle
LocalFree
lstrcpynW
lstrcpyW
lstrlenW
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
GetUserDefaultUILanguage
SetConsoleCtrlHandler
QueryPerformanceCounter
GetTickCount
GetModuleHandleA
lstrlenA
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
CompareStringW
CopyFileW
SetUnhandledExceptionFilter
ole32
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateInstanceEx
CoCreateInstance
CoInitializeSecurity
oleaut32
SysStringLen
SysFreeString
SysAllocStringByteLen
VariantClear
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantInit
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
VariantChangeType
VariantCopy
SysStringByteLen
SafeArrayGetVartype
SysAllocString
user32
SetClipboardData
EmptyClipboard
OpenClipboard
LoadStringW
CloseClipboard
wsprintfW
CharUpperW
framedyn
?FindOneOf@CHString@@QBEHPBG@Z
?GetBuffer@CHString@@QAEPAGH@Z
?TrimRight@CHString@@QAEXXZ
?TrimLeft@CHString@@QAEXXZ
??0CHString@@QAE@PBG@Z
?Mid@CHString@@QBE?AV1@H@Z
??YCHString@@QAEABV0@ABV0@@Z
?GetData@CHString@@IBEPAUCHStringData@@XZ
?Left@CHString@@QBE?AV1@H@Z
?Find@CHString@@QBEHPBG@Z
??0CHString@@QAE@ABV0@@Z
??4CHString@@QAEABV0@PBG@Z
??0CHString@@QAE@XZ
??1CHString@@QAE@XZ
?Empty@CHString@@QAEXXZ
??YCHString@@QAEABV0@PBG@Z
??0CHString@@QAE@PBD@Z
??H@YG?AVCHString@@ABV0@PBG@Z
?Right@CHString@@QBE?AV1@H@Z
??4CHString@@QAEABV0@ABV0@@Z
?Format@CHString@@QAAXPBGZZ
shlwapi
StrStrIW
ws2_32
gethostbyname
WSACleanup
WSAStartup
inet_addr
secur32
GetUserNameExW
iphlpapi
IcmpSendEcho
IcmpCreateFile
IcmpCloseHandle
Sections
.text Size: 289KB - Virtual size: 289KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PACK Size: 144KB - Virtual size: 380KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE