d:\LastGuardian\Release\LastGuardian.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ebfce90a5632644198c6b6d7e4ccc476_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ebfce90a5632644198c6b6d7e4ccc476_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ebfce90a5632644198c6b6d7e4ccc476_JaffaCakes118
-
Size
52KB
-
MD5
ebfce90a5632644198c6b6d7e4ccc476
-
SHA1
e8fc1452b5135b397491ceb89bbf08adbec6d2ea
-
SHA256
f6f0805d123e09be6392ea38a779e9c7ab6a2e538a35137de42e919c36ce733f
-
SHA512
dacc93cd902e2d13917795b45d0f41051b19c66ec3b353666cba1d6a496d0130281d6fda2073ffbe8cf548d6fb6469a9e914bb9b19f1e4f5e8c31d6188ac03a5
-
SSDEEP
1536:pXpfL1H8Eegec2QWU+w+8GgGE+g+8Ww20eQecGgGEegec2QWU+w+8GgGE+g+8WwQ:7J8Eegec2QWU+w+8GgGE+g+8Ww20eQeF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ebfce90a5632644198c6b6d7e4ccc476_JaffaCakes118
Files
-
ebfce90a5632644198c6b6d7e4ccc476_JaffaCakes118.exe windows:4 windows x86 arch:x86
b344c335410276493140ecef89a7f892
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetModuleHandleW
GlobalSize
GlobalLock
GlobalUnlock
GetSystemWindowsDirectoryW
CreateMutexW
InitializeCriticalSection
CreateEventW
SetEvent
WaitForSingleObject
lstrlenW
GetSystemDirectoryW
SetLastError
GetSystemTime
LeaveCriticalSection
HeapAlloc
HeapFree
GetProcessHeap
ExitProcess
GetCommandLineW
GetStartupInfoW
EnterCriticalSection
CreateProcessW
GetTempFileNameW
GetTempPathW
CopyFileW
Sleep
MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
GetTickCount
WriteFile
SetFileAttributesW
GetLastError
ReadFile
GetFileSize
CreateFileW
GetModuleFileNameW
VirtualQuery
GetLogicalDrives
GetComputerNameW
CreateThread
CloseHandle
TerminateThread
SystemTimeToFileTime
dinput8
DirectInput8Create
iphlpapi
GetIpNetTable
IcmpCreateFile
IcmpSendEcho
ws2_32
inet_ntoa
gethostbyaddr
inet_addr
netapi32
NetUserEnum
NetApiBufferFree
NetShareEnum
mpr
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
winhttp
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpConnect
WinHttpOpenRequest
WinHttpOpen
WinHttpCloseHandle
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
oleaut32
VariantClear
VariantInit
SysFreeString
SysAllocString
user32
GetForegroundWindow
EnumChildWindows
GetWindowTextW
UnregisterDeviceNotification
RegisterDeviceNotificationW
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
ToUnicodeEx
MapVirtualKeyExW
GetKeyboardState
GetKeyboardLayout
SendMessageW
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
advapi32
ControlService
CloseServiceHandle
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegCreateKeyExW
RegConnectRegistryW
CreateServiceW
QueryServiceStatus
OpenServiceW
ChangeServiceConfigW
ChangeServiceConfig2W
StartServiceW
OpenSCManagerW
ole32
CoInitializeSecurity
CoCreateInstance
CoInitializeEx
Exports
Exports
ServiceMain
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE