c:\projects\pc connectivity solution\pccs 3.4\source files\platform\media servers\nclrssrv\mediahandler\win32\release\NclRSSrv.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fad29d1ff1c09bb979c169417fd3f12d_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fad29d1ff1c09bb979c169417fd3f12d_JaffaCakes118
-
Size
231KB
-
MD5
fad29d1ff1c09bb979c169417fd3f12d
-
SHA1
8fe2c590827f297f3cdc54ceffeeef3a327b0541
-
SHA256
c748026354a9455d841d693dc35a3b20d31260231ab97a40d2a4fff9deec6ba1
-
SHA512
5db5148d4c3644d7c775432e3dadb13610ab9c763ff83d276a81e0e636186c7843572a0eca136023ce463289b1b1c9b9a2358dc9ed22863cb5f095d6fbefd5a0
-
SSDEEP
6144:USfEKbx3TV/z16Mt3w7bnOaIaWjoWzYAOxjpW:UScKl5zu7bnjImwYAOxjpW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fad29d1ff1c09bb979c169417fd3f12d_JaffaCakes118
Files
-
fad29d1ff1c09bb979c169417fd3f12d_JaffaCakes118.exe windows:4 windows x86 arch:x86
7f455fd27cb936f7cfa0d71b99826627
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
MultiByteToWideChar
SetCommMask
PurgeComm
ClearCommError
WaitCommEvent
CreateFileW
GetCommModemStatus
SetThreadPriority
SetEvent
CancelIo
WaitForSingleObject
DisconnectNamedPipe
TerminateThread
ReleaseMutex
CloseHandle
HeapFree
GetCurrentThreadId
HeapSize
ExitThread
HeapValidate
ReadFile
GetLastError
GetProcessHeap
WaitForMultipleObjects
HeapAlloc
SetCommState
IsBadCodePtr
CreateMutexW
GetOverlappedResult
WriteFile
PeekNamedPipe
ConnectNamedPipe
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
GetCurrentProcess
GetProcAddress
FlushFileBuffers
CreateFileA
GetStringTypeW
GetStringTypeA
CreateThread
GetCommState
CreateEventW
Sleep
lstrlenW
ResetEvent
GetTickCount
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LoadLibraryA
IsValidCodePage
GetOEMCP
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
user32
UnregisterClassW
GetMessageW
DispatchMessageW
RegisterClassExW
PostMessageW
CharUpperBuffW
PostQuitMessage
DefWindowProcW
UpdateWindow
ShowWindow
CreateWindowExW
advapi32
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW
ole32
StringFromCLSID
CoTaskMemFree
CLSIDFromString
oleaut32
VarBstrCmp
SysFreeString
SysAllocStringLen
SysStringLen
VarBstrCat
SysAllocStringByteLen
SysStringByteLen
SysAllocString
Sections
.text Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 113KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE