t:\click2run\x86\ship\0\virtualowssupphost.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0f851e2467b52cdff44aeb1eda516577_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0f851e2467b52cdff44aeb1eda516577_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0f851e2467b52cdff44aeb1eda516577_JaffaCakes118
-
Size
223KB
-
MD5
0f851e2467b52cdff44aeb1eda516577
-
SHA1
123556765c319e645af533737be7c7ebae621f20
-
SHA256
110f1ed7e13fe4aa47a2b730f4c4e3383e2f566e37d2b45a232af54444092e52
-
SHA512
36ca5275c78882fd140cf6f8d2eb1dcc65d5e0d7696a6877c5afe46c9c2efb6e0974bdb588f07497b0de150c2803003561ba1882e0b13337d0862e5c57274fe6
-
SSDEEP
6144:5ylIeifmOFLcZRYvAjeuAf+N9bTwrYje:oNZOSZAW9bmYj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f851e2467b52cdff44aeb1eda516577_JaffaCakes118
Files
-
0f851e2467b52cdff44aeb1eda516577_JaffaCakes118.exe windows:5 windows x86 arch:x86
7207522a9f558d6cb43fe920957efa3a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcr90
swprintf_s
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??3@YAXPAX@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_crt_debugger_hook
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
vswprintf_s
??2@YAPAXI@Z
memset
??_U@YAPAXI@Z
_recalloc
_vsnprintf_s
wcsncpy_s
_CxxThrowException
memcpy_s
free
malloc
wcsstr
__CxxFrameHandler3
??_V@YAXPAX@Z
msvcp90
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W0@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W0@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
advapi32
ConvertSidToStringSidW
LookupAccountNameW
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
kernel32
SetDllDirectoryW
LocalFree
OpenEventW
WideCharToMultiByte
CompareStringW
CompareStringA
GetVersionExW
GetModuleHandleA
GetModuleHandleW
CloseHandle
WaitForSingleObject
GetProcAddress
GetFileAttributesW
GetVersion
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiW
Sleep
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
CreateThread
CreateEventW
LoadLibraryExW
GetCurrentProcessId
GetCurrentThreadId
SetEvent
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
GetCommandLineW
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetProcessHeap
HeapFree
HeapAlloc
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsFree
InitializeCriticalSectionAndSpinCount
HeapReAlloc
GetLastError
ole32
CoTaskMemFree
CoRegisterClassObject
CoTaskMemRealloc
CoTaskMemAlloc
CoSuspendClassObjects
CoUninitialize
CoResumeClassObjects
CLSIDFromProgID
CoCreateInstance
CoInitializeEx
CoRevokeClassObject
oleaut32
VarUI4FromStr
user32
CharLowerA
CharLowerW
DispatchMessageW
TranslateMessage
GetMessageW
PostThreadMessageW
CharNextW
CharUpperW
secur32
GetUserNameExW
dbghelp
SymCleanup
Sections
.text Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PACK Size: 160KB - Virtual size: 416KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE