rmactivate_isv.pdb
Behavioral task
behavioral1
Sample
ef9a70dbf1af3119b1a782beec751a92_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
ef9a70dbf1af3119b1a782beec751a92_JaffaCakes118
-
Size
622KB
-
MD5
ef9a70dbf1af3119b1a782beec751a92
-
SHA1
4c4595c07795cea4988c1b919ba7ebbbe6e0e8fc
-
SHA256
8cadc074e701fec9edb360560ffa6998a36f556d1d20dec9e57e86b49b95f4c8
-
SHA512
e1edd3086242728851a2a9fe90ca1d59c170cc26943f27f74b2b6db9c1f645dbd942ef0d27270e1c955b29f37a098a3cc78e2f136d1671aebfde4b458dfddcb5
-
SSDEEP
12288:k+S3uesITLjMET4GECou09vKRjLwALu0HzUJf:kB3uebL5Ec0BKbLu0HoJ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef9a70dbf1af3119b1a782beec751a92_JaffaCakes118
Files
-
ef9a70dbf1af3119b1a782beec751a92_JaffaCakes118.exe windows:6 windows x86 arch:x86
8e4bc1244b33fad546855098e17c9a10
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntdll
RtlUnwind
advapi32
CryptDuplicateKey
CryptVerifySignatureA
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsA
UnregisterTraceGuids
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptDestroyKey
CryptExportKey
CryptGenKey
CryptDecrypt
CryptDeriveKey
CryptEncrypt
CryptGenRandom
CryptGetDefaultProviderW
CryptGetProvParam
RegCloseKey
RegQueryValueExW
RegOpenKeyExA
CryptReleaseContext
CryptAcquireContextW
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
CryptImportKey
CryptSetKeyParam
CryptGetKeyParam
CryptSetHashParam
kernel32
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
OutputDebugStringA
FreeLibrary
InterlockedExchange
HeapFree
InitializeCriticalSection
GetModuleHandleW
GetCPInfo
GetACP
GetOEMCP
Sleep
UnhandledExceptionFilter
LCMapStringA
MultiByteToWideChar
LocalAlloc
GetStringTypeA
GetStringTypeW
GetModuleHandleA
GetLocaleInfoA
TerminateProcess
GetCurrentProcess
VirtualProtect
GetSystemInfo
VirtualQuery
HeapSetInformation
GetSystemTime
LocalFree
CreateMutexA
ReleaseMutex
CloseHandle
CreateFileW
WaitForSingleObject
DeleteFileW
SetFilePointer
ReadFile
RaiseException
GetVolumeInformationA
GetDriveTypeA
lstrlenA
GetLogicalDriveStringsA
DeviceIoControl
CreateFileA
GetProcessHeap
QueryDosDeviceW
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
GetModuleFileNameW
LoadLibraryW
GetSystemWindowsDirectoryW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
GetSystemDirectoryW
GetVersion
GetProcAddress
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
GetLastError
HeapAlloc
GetVersionExA
GetCommandLineA
SetUnhandledExceptionFilter
LoadLibraryA
LCMapStringW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
HeapSize
msdrm
__AddMachineCertToLicenseStore
crypt32
CryptProtectData
ole32
CoCreateGuid
shfolder
SHGetFolderPathW
Exports
Exports
?SPVersion@@3PADA
Sections
.text Size: 430KB - Virtual size: 430KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE