EvCreate.pdb
Behavioral task
behavioral1
Sample
fa55efcd63ffaf30dd1185331cbbf862_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fa55efcd63ffaf30dd1185331cbbf862_JaffaCakes118
-
Size
159KB
-
MD5
fa55efcd63ffaf30dd1185331cbbf862
-
SHA1
036b1ff28347bf59ddd9e5b0d5310f7ae4814470
-
SHA256
3ac5c7641f53dd31f168ef4f7a2765f9fe7804894eb2901ce1276f527119cdf5
-
SHA512
e9f96c5a3345a41174bb91936d2f9d23c143d693fb938bd4734c12a48eb26d106d2fea2ca04c6627a8813aac042cdb19ac9843b7482608fbebb4b26cde1d365f
-
SSDEEP
3072:wDrKC0ggVGMua//bsv6NC3o8ynUytNjUIXqBQkmTn9XRFyepZ47GUQTWG:wDfg8MBbmLGUyn4B3EXRES47GbTWG
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa55efcd63ffaf30dd1185331cbbf862_JaffaCakes118
Files
-
fa55efcd63ffaf30dd1185331cbbf862_JaffaCakes118.exe windows:5 windows x86 arch:x86
fd9c9502ed4db9717167c65abaf39f81
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_controlfp
wcstod
wcstol
wcsstr
wcsncmp
_wcsnicmp
realloc
fflush
fprintf
wcschr
wcstok
strtok
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
swprintf
_iob
_wcsdup
calloc
free
advapi32
OpenEventLogW
ReportEventW
DeregisterEventSource
CloseEventLog
RegConnectRegistryW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegisterEventSourceW
kernel32
GetProcAddress
FreeLibrary
lstrcpynW
WideCharToMultiByte
LoadLibraryW
VerifyVersionInfoW
GetModuleHandleA
GetComputerNameExW
UnhandledExceptionFilter
LocalFree
FormatMessageW
MultiByteToWideChar
ReadConsoleW
ReadFile
WriteConsoleW
SetConsoleMode
GetConsoleMode
GetStdHandle
VerSetConditionMask
SetUnhandledExceptionFilter
lstrcpyW
SetLastError
lstrlenW
lstrcmpW
lstrcatW
lstrcmpiW
GetLastError
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
user32
wsprintfW
CharUpperW
LoadStringW
mpr
WNetGetLastErrorW
WNetCancelConnection2W
WNetAddConnection2W
secur32
GetUserNameExW
ws2_32
WSACleanup
gethostbyaddr
inet_addr
WSAGetLastError
WSAStartup
netapi32
NetApiBufferFree
NetServerGetInfo
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 21B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE