d:\nightly2009\Powerword2009\CBUpdate\sup\rebug\sup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
30d20d58e48fc25a66ec9a281ea80b4b_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
30d20d58e48fc25a66ec9a281ea80b4b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
30d20d58e48fc25a66ec9a281ea80b4b_JaffaCakes118
-
Size
628KB
-
MD5
30d20d58e48fc25a66ec9a281ea80b4b
-
SHA1
f1fbb9a64c1059b5fe9b9d457510ea7d6c3ebbe1
-
SHA256
d75fb458b04d23803663f79df2dc40f5e8f6601403a172966051454af9a393c8
-
SHA512
e3ea16a5149f803b0760b3c1d7d9d422c76c7f3aaced53f1b6e11d2333b8d77c84ab31cbc1a05d6f1f0a23bd1fc1bca2bf3e2d66253792ae3b0e98d3a496849d
-
SSDEEP
12288:dLAGkJY260zqVu8ThqVLZEXVdzdXJ5CugdsmADKZW8yVQPgy:BGqKVWzF7CugaHDKZhUi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30d20d58e48fc25a66ec9a281ea80b4b_JaffaCakes118
Files
-
30d20d58e48fc25a66ec9a281ea80b4b_JaffaCakes118.exe windows:4 windows x86 arch:x86
1b051f5e1708a9f339219e41f7f96e16
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
GetTokenInformation
EqualSid
AllocateAndInitializeSid
FreeSid
OpenProcessToken
psapi
EnumProcesses
GetModuleBaseNameA
EnumProcessModules
upcheck
?Start@Cupcheck@@QAEXXZ
??1Cupcheck@@UAE@XZ
??0Cupcheck@@QAE@PAPAUHWND__@@H@Z
?SetCheckFlag@Cupcheck@@QAEXH@Z
?SetProxyInfo@Cupcheck@@QAEXPAUProxyInfo@@@Z
kernel32
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetTimeZoneInformation
CreateFileA
ExitProcess
InterlockedDecrement
WaitForSingleObject
SetEvent
InitializeCriticalSection
TerminateThread
LeaveCriticalSection
CreateSemaphoreA
ReleaseSemaphore
EnterCriticalSection
CreateEventW
DeleteCriticalSection
CloseHandle
GetCurrentProcess
GetModuleFileNameW
OpenProcess
GetCurrentProcessId
lstrlenW
FlushInstructionCache
RaiseException
SetLastError
GetCurrentThreadId
GetLastError
MultiByteToWideChar
WideCharToMultiByte
LocalFree
FormatMessageA
SleepEx
DuplicateHandle
ReleaseMutex
WaitForMultipleObjects
CreateEventA
CreateMutexA
GetExitCodeThread
GetTickCount
ReadFile
PeekNamedPipe
GetFileType
GetStdHandle
FreeLibrary
GetProcAddress
LoadLibraryA
Sleep
ExpandEnvironmentStringsA
InterlockedIncrement
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetVersionExA
SetStdHandle
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapSize
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetOEMCP
GetACP
GetCurrentDirectoryA
GetFullPathNameA
QueryPerformanceCounter
HeapCreate
HeapDestroy
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
WriteFile
GetCPInfo
LCMapStringW
CreateFileW
LCMapStringA
GetFileInformationByHandle
SetFilePointer
GetSystemTimeAsFileTime
RtlUnwind
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
HeapReAlloc
CreateDirectoryW
CreateDirectoryA
GetModuleHandleA
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CreateThread
ExitThread
GetStartupInfoW
user32
LoadIconW
DialogBoxParamW
DispatchMessageW
EndDialog
TranslateMessage
SetWindowLongW
GetWindowLongW
GetMessageW
UnregisterClassA
TranslateAcceleratorW
CallWindowProcW
DefWindowProcW
CreateWindowExW
RegisterClassExW
LoadCursorW
PostMessageW
LoadAcceleratorsW
LoadStringW
GetClassInfoExW
DestroyWindow
PostQuitMessage
ole32
CoInitialize
shell32
SHGetFolderPathW
oleaut32
VariantClear
SysAllocStringLen
SysStringLen
SysAllocString
SysFreeString
wldap32
ord27
ord41
ord46
ord301
ord200
ord79
ord33
ord35
ord32
ord30
ord26
ord50
ord60
ord143
ord22
ord211
ws2_32
listen
setsockopt
WSAGetLastError
recv
send
WSACleanup
WSAStartup
closesocket
htons
ioctlsocket
ntohs
getsockname
bind
inet_addr
select
__WSAFDIsSet
getsockopt
accept
recvfrom
sendto
inet_ntoa
WSASetLastError
connect
socket
gethostbyname
Sections
.text Size: 292KB - Virtual size: 289KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tc Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE