mstordb.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2dc20225b27cdace64f246b48a50c9f2_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2dc20225b27cdace64f246b48a50c9f2_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2dc20225b27cdace64f246b48a50c9f2_JaffaCakes118
-
Size
606KB
-
MD5
2dc20225b27cdace64f246b48a50c9f2
-
SHA1
cf46e743e3b486708e5f48c85cfedf1c5b161a14
-
SHA256
79191224a21cd4c9a5bdbb52480c27832aca70d3b3985b53ae84562a14fdf40c
-
SHA512
d6bb9724199ad9ca3aa0b7b1a21d1280de929f36c6c98dca69551240cb622ab6626495013dc1af0d684b5eecdb9ac7155aa30749b2973d806c11f0b1cd6c8707
-
SSDEEP
12288:RGSZwh3pR5OUxfUxLhnlQgsCqwHt3WoSGqj+wPctLQWEtaB2oAVDcrg5DJ:ADR/fUnumSt5uLAVD6S
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dc20225b27cdace64f246b48a50c9f2_JaffaCakes118
Files
-
2dc20225b27cdace64f246b48a50c9f2_JaffaCakes118.exe windows:4 windows x86 arch:x86
f324aa6a048fbedb8e6cd443d639c251
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_controlfp
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_amsg_exit
_wcmdln
_except_handler3
exit
_cexit
_XcptFilter
_exit
_c_exit
?terminate@@YAXXZ
_onexit
__dllonexit
memset
_beginthread
_wtol
wcscpy
swscanf
_wcsdup
wcsstr
_setjmp3
longjmp
strncmp
_wsplitpath
_wcsnicmp
_ltow
_vsnwprintf
wcsrchr
_wtoi64
_wtoi
wcstod
_wcsicmp
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
realloc
_iob
fprintf
fread
fflush
fwrite
_vsnprintf
calloc
??1exception@@UAE@XZ
wcstoul
wcscmp
wcsncmp
wcschr
wcslen
??2@YAPAXI@Z
__CxxFrameHandler
malloc
memmove
??3@YAXPAX@Z
_CxxThrowException
free
_CIpow
kernel32
GetStartupInfoW
VirtualQuery
GetSystemInfo
VirtualAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetVersionExA
GetModuleHandleA
LockFile
LockFileEx
UnlockFileEx
UnlockFile
GetFileInformationByHandle
SetEndOfFile
GetCommandLineW
GetCurrentThreadId
Sleep
GetModuleHandleW
FindResourceW
LoadResource
SizeofResource
FreeLibrary
lstrcpynW
GetModuleFileNameW
CreateThread
WaitForSingleObject
SetEvent
CreateEventW
CompareStringW
FlushFileBuffers
RaiseException
InitializeCriticalSection
DeleteCriticalSection
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
GetLastError
LCMapStringW
GetUserDefaultLCID
lstrlenW
lstrlenA
InterlockedDecrement
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
GetFileAttributesW
CloseHandle
ReadFile
SetFilePointer
CreateFileW
MoveFileW
DeleteFileW
GlobalUnlock
GlobalLock
GetTempFileNameW
GetTempPathW
WriteFile
HeapFree
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapCreate
SystemTimeToFileTime
MultiByteToWideChar
GlobalFree
GlobalAlloc
GetDiskFreeSpaceExW
lstrcmpiW
LoadLibraryExW
user32
ReleaseDC
GetDC
GetDesktopWindow
LoadImageA
FindWindowA
CharNextW
PostThreadMessageA
DispatchMessageA
LoadStringW
SetTimer
GetMessageA
gdi32
GetDIBits
GetObjectW
DeleteObject
advapi32
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
ole32
CoCreateInstance
CoTaskMemFree
CLSIDFromString
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateGuid
StringFromGUID2
CreateStreamOnHGlobal
CoUninitialize
CoInitializeEx
CoRevokeClassObject
CoRegisterClassObject
CoInitialize
oleaut32
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SafeArrayDestroy
VariantTimeToSystemTime
VariantChangeTypeEx
VariantCopy
VariantClear
VariantInit
VarBstrCmp
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocString
wininet
InternetCloseHandle
HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
shlwapi
PathFindExtensionW
Exports
Exports
_resetstkoflw
Sections
.text Size: 575KB - Virtual size: 575KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cdata Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.WYCao Size: 16KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ