upnpui.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ef5af683c8dda88d48ee3497b56c61ba_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef5af683c8dda88d48ee3497b56c61ba_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ef5af683c8dda88d48ee3497b56c61ba_JaffaCakes118
-
Size
2.8MB
-
MD5
ef5af683c8dda88d48ee3497b56c61ba
-
SHA1
693b34cf74e25234de5358cc335dab83745bfdc8
-
SHA256
cb1c37b8d1e441cfdb5c026488a9b6bc2e1ce365a22ed4c2189dc3436bcaa9f7
-
SHA512
83824a52df3d6175137cdc47b8d2c133537dc294ebca6ba425d74867ec9aeabb811f86fcabb721e6b5ef07657bf3203408df76774cf68f547f64e08805eb75b1
-
SSDEEP
49152:ZQTBALttl2+FrMiwx3CWrCnsR6NWQNlVKWLqNw5zu7T9N4es4Q:ZQoPhEt0NBlVxbzuH9NlQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef5af683c8dda88d48ee3497b56c61ba_JaffaCakes118
Files
-
ef5af683c8dda88d48ee3497b56c61ba_JaffaCakes118.exe windows:5 windows x86 arch:x86
3688a3ec171f54457e785b04c0637743
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
sprintf
wcslen
sscanf
strstr
wcsrchr
wcscpy
_snprintf
wcscmp
_except_handler3
advapi32
RegCreateKeyW
RegSetValueExA
RegDeleteValueA
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyW
RegEnumValueA
RegSetValueExW
RegDeleteValueW
RegCreateKeyExA
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
OpenSCManagerW
OpenServiceW
ControlService
CloseServiceHandle
RegQueryValueExA
RegQueryValueA
kernel32
GetFileType
CreateFileA
WideCharToMultiByte
lstrlenW
lstrcpynW
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LoadLibraryA
PurgeComm
SetCommMask
GetTempPathA
SetCommTimeouts
GetVersionExA
FormatMessageW
GetModuleHandleW
GetModuleFileNameW
GetWindowsDirectoryW
WriteFile
CreateMutexW
SetLastError
CreateEventW
EscapeCommFunction
ClearCommError
GetTempFileNameA
MultiByteToWideChar
SetupComm
DeleteFileA
GetFileInformationByHandle
SetFilePointer
SetEndOfFile
GetSystemDirectoryA
FlushFileBuffers
GetLocalTime
GetDateFormatW
GetTimeFormatW
ReleaseMutex
WaitForSingleObject
LocalSize
lstrcmpiW
IsBadStringPtrW
InterlockedExchange
LocalAlloc
LocalFree
IsBadWritePtr
UnmapViewOfFile
CloseHandle
GetCurrentProcessId
GetLastError
CreateFileMappingA
MapViewOfFileEx
ReadFile
lstrcmpiA
GetProcAddress
FreeLibrary
IsBadCodePtr
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount
GetCommandLineA
lstrcpynA
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
lstrlenA
GetModuleHandleA
CreateProcessA
CreateFileW
IsBadReadPtr
user32
wsprintfA
CharNextA
wvsprintfW
CharNextW
SendMessageTimeoutW
wsprintfW
SetCursor
LoadCursorA
ole32
CoUninitialize
FreePropVariantArray
CLSIDFromString
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
HWND_UserSize
HWND_UserMarshal
HWND_UserUnmarshal
HWND_UserFree
STGMEDIUM_UserSize
STGMEDIUM_UserMarshal
STGMEDIUM_UserUnmarshal
STGMEDIUM_UserFree
CoInitialize
rpcrt4
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
NdrClientCall2
RpcBindingFromStringBindingW
RpcStringBindingComposeW
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
RpcBindingFree
CStdStubBuffer_IsIIDSupported
RpcBindingSetAuthInfoExW
RpcStringFreeW
CStdStubBuffer_DebugServerRelease
NdrDllUnregisterProxy
cfgmgr32
CM_Reenumerate_DevNode
CM_Get_DevNode_Status
CM_Get_Parent
setupapi
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiOpenDeviceInterfaceRegKey
SetupDiOpenDevRegKey
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
Sections
.text Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2.7MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ