WMIC.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0f5af20e2fe68fb8c818ea3870ddee46_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0f5af20e2fe68fb8c818ea3870ddee46_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0f5af20e2fe68fb8c818ea3870ddee46_JaffaCakes118
-
Size
359KB
-
MD5
0f5af20e2fe68fb8c818ea3870ddee46
-
SHA1
ebb5cbfdcbcf33d4eb61f5dc1a92be481112eb97
-
SHA256
e1f0f1f350a54e7fc0e8030ca4d84b0bff6b8bc80ff40c064924665a7c2cb091
-
SHA512
2be9440397211c902a3f9917cefcf4b7ee3f14dfa7d3e8e2198f953b36f600863a419d05ea26e82b9ea2071bd2eca30271ef88278846a80ef55444c4ddc144c5
-
SSDEEP
6144:Rsxm+QHH9FSgaEx18L3X4BuLHlNdpSKMYLDYwVPBX++:Rsw+QH+gR0LFxlM+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f5af20e2fe68fb8c818ea3870ddee46_JaffaCakes118
Files
-
0f5af20e2fe68fb8c818ea3870ddee46_JaffaCakes118.exe windows:5 windows x86 arch:x86
9568be97a635354a409e5b38875082fa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
?terminate@@YAXXZ
_controlfp
??2@YAPAXI@Z
__CxxFrameHandler
swprintf
_ltow
_CxxThrowException
_wcsicmp
wcstok
??1type_info@@UAE@XZ
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
_wfreopen
_wtoi64
_i64tow
_kbhit
_filelength
_wremove
fputws
fprintf
fflush
fwprintf
wcsncpy
wcsncmp
fread
fseek
towlower
swscanf
wctomb
wcsstr
fgets
wcscmp
wcstoul
_wfopen
fwrite
fclose
_ftol
_getch
ceil
_wsystem
_wtoi
_itow
wcslen
??0exception@@QAE@ABV0@@Z
_iob
fgetws
sprintf
_wcsnicmp
wcscpy
_wtol
??3@YAXPAX@Z
msvcp60
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIPBG@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?data@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??0logic_error@std@@QAE@ABV01@@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
advapi32
RegCloseKey
RegOpenKeyExW
GetTokenInformation
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
kernel32
CompareFileTime
CreateEventW
CreateThread
SetEvent
WaitForSingleObject
DeleteFileW
GetCommandLineW
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
LocalAlloc
LoadLibraryW
FreeLibrary
GetProcAddress
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentProcess
SetConsoleScreenBufferSize
GetConsoleMode
SetConsoleMode
ReadConsoleW
SetConsoleCursorPosition
WriteConsoleW
WideCharToMultiByte
GetFileTime
MultiByteToWideChar
GetComputerNameW
GetSystemDefaultUILanguage
GetConsoleScreenBufferInfo
FormatMessageW
GetStdHandle
GetFileType
lstrcatW
GetLocalTime
GetFileSizeEx
GetLastError
WriteFile
CreateFileW
SetFilePointer
SetLastError
CloseHandle
LocalFree
lstrcpynW
lstrcpyW
lstrlenW
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
GetUserDefaultUILanguage
SetConsoleCtrlHandler
QueryPerformanceCounter
GetTickCount
GetModuleHandleA
lstrlenA
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
CompareStringW
CopyFileW
SetUnhandledExceptionFilter
ole32
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateInstanceEx
CoCreateInstance
CoInitializeSecurity
oleaut32
SysStringLen
SysFreeString
SysAllocStringByteLen
VariantClear
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantInit
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
VariantChangeType
VariantCopy
SysStringByteLen
SafeArrayGetVartype
SysAllocString
user32
SetClipboardData
EmptyClipboard
OpenClipboard
LoadStringW
CloseClipboard
wsprintfW
CharUpperW
framedyn
?FindOneOf@CHString@@QBEHPBG@Z
?GetBuffer@CHString@@QAEPAGH@Z
?TrimRight@CHString@@QAEXXZ
?TrimLeft@CHString@@QAEXXZ
??0CHString@@QAE@PBG@Z
?Mid@CHString@@QBE?AV1@H@Z
??YCHString@@QAEABV0@ABV0@@Z
?GetData@CHString@@IBEPAUCHStringData@@XZ
?Left@CHString@@QBE?AV1@H@Z
?Find@CHString@@QBEHPBG@Z
??0CHString@@QAE@ABV0@@Z
??4CHString@@QAEABV0@PBG@Z
??0CHString@@QAE@XZ
??1CHString@@QAE@XZ
?Empty@CHString@@QAEXXZ
??YCHString@@QAEABV0@PBG@Z
??0CHString@@QAE@PBD@Z
??H@YG?AVCHString@@ABV0@PBG@Z
?Right@CHString@@QBE?AV1@H@Z
??4CHString@@QAEABV0@ABV0@@Z
?Format@CHString@@QAAXPBGZZ
shlwapi
StrStrIW
ws2_32
gethostbyname
WSACleanup
WSAStartup
inet_addr
secur32
GetUserNameExW
iphlpapi
IcmpSendEcho
IcmpCreateFile
IcmpCloseHandle
Sections
.text Size: 289KB - Virtual size: 289KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE