WSManHTTPConfig.pdb
Behavioral task
behavioral1
Sample
2dc4882aef7d0d352bea93c3636444ab_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
2dc4882aef7d0d352bea93c3636444ab_JaffaCakes118
-
Size
337KB
-
MD5
2dc4882aef7d0d352bea93c3636444ab
-
SHA1
ccb4a597dbd5aa3ef8632ba44c1c8dc0173c0220
-
SHA256
da5245d4510d2a73619cd9543cc304a48fd6ace9f393ded2cfb3ff87bf0bb5e4
-
SHA512
bbd6d634ed1bf8fdb2867e725d35bbd793e7c1d1e2ec1a6c5a5d140aae365990bb086e3d3cef489f00cf1f513dbff88afdd9bd4fd1f0d3966bdbabcf85e720e0
-
SSDEEP
6144:vRxVfaf1N/4+j/UCjE9nLuSynhNLKugju/8iCcHFXIxeVhEmS9WDKSEdjU+Vk:vRxVfaf1N/4N7DuP8iCcHF4xekmdS
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dc4882aef7d0d352bea93c3636444ab_JaffaCakes118
Files
-
2dc4882aef7d0d352bea93c3636444ab_JaffaCakes118.exe windows:6 windows x86 arch:x86
7db40682af3f8fb2e321ffe44c5ba866
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateFileW
GetFullPathNameW
CreateEventW
RegisterWaitForSingleObject
UnregisterWaitEx
EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetSystemDirectoryW
GetComputerNameExW
InterlockedIncrement
InterlockedDecrement
GetLocaleInfoW
EnumUILanguagesW
ExpandEnvironmentStringsW
OutputDebugStringA
HeapSetInformation
LoadLibraryW
GetProcAddress
FreeLibrary
LocalAlloc
LocalFree
InterlockedExchange
Sleep
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetLastError
GetLastError
MultiByteToWideChar
CloseHandle
GetCurrentThread
WideCharToMultiByte
CompareStringW
GetVersionExW
msvcrt
wcstoul
_itow
iswalnum
_ultow
??1type_info@@UAE@XZ
memcpy
_wcsicmp
fwprintf
_iob
__CxxFrameHandler3
__wgetmainargs
_cexit
_exit
_purecall
??0exception@@QAE@XZ
_wtoi
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
_unlock
__dllonexit
_lock
_onexit
_scwprintf
_CxxThrowException
memset
wcschr
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
memmove_s
memcpy_s
_vsnwprintf
_wtoi64
iswspace
wcsncmp
_wcsnicmp
wcsstr
ntdll
EtwLogTraceEvent
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwEventRegister
EtwEventUnregister
EtwEventWrite
EtwEventEnabled
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
oleaut32
SysAllocString
SysFreeString
SysStringLen
VarCmp
VariantClear
VariantInit
httpapi
HttpDeleteServiceConfiguration
HttpTerminate
HttpSetServiceConfiguration
HttpQueryServiceConfiguration
HttpInitialize
wsmsvc
?AllocBstr@WSManMemory@@SGPAGPBGHABVCallSite@TestSystem@@@Z
?Alloc@WSManMemory@@SGPAXIABVCallSite@TestSystem@@W4Mode@3@@Z
?Free@WSManMemory@@SGXPAXABVCallSite@TestSystem@@@Z
advapi32
GetLengthSid
CopySid
FreeSid
AllocateAndInitializeSid
CreateWellKnownSid
SetThreadToken
RevertToSelf
IsWellKnownSid
RegConnectRegistryW
CredDeleteW
CredReadW
CredWriteW
CredFree
LogonUserW
RegCreateKeyExW
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
RegSetValueExW
GetTokenInformation
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
OpenProcessToken
GetSecurityDescriptorDacl
GetAce
MapGenericMask
RegCloseKey
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenThreadToken
crypt32
CertFindExtension
CryptStringToBinaryW
CertGetNameStringW
CertOpenStore
CertFindCertificateInStore
CryptAcquireCertificatePrivateKey
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertCloseStore
CertGetCertificateContextProperty
CryptBinaryToStringW
CertGetEnhancedKeyUsage
CertFreeCertificateChain
CertFreeCertificateContext
CryptDecodeObjectEx
netutils
NetApiBufferFree
wkscli
NetGetJoinInformation
rpcrt4
UuidCreate
ws2_32
getnameinfo
WSAStartup
freeaddrinfo
getaddrinfo
WSACleanup
Sections
.text Size: 166KB - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE