d:\dbs\el\dec\target\x64\ship\setupexe\x-none\LicLua.pdb
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4964e20c78ec9af68bac8a4684fa1b86.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_4964e20c78ec9af68bac8a4684fa1b86
-
Size
959KB
-
MD5
4964e20c78ec9af68bac8a4684fa1b86
-
SHA1
ce11c2a1775b1fc300bdf5caae2fd3e3a654dab1
-
SHA256
b98b4a58ffc62e2300baa88e627c709a0b8a2eaecfecabe9f93a6b3db4902b23
-
SHA512
9a284ba56e8e1a226179e88a49ff7e9a5b361bbc845aed4beb38e2aca81d7313270d2f9a75760106a0043aba83aabd3c33be18bb1ac2756e03f2a641988748f7
-
SSDEEP
24576:vPfAPgUYrPXPWeB7S53PW6DmIUVPulHTb9OLf:vXAqrP/WH5/WUmIUVWVTb9OL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_4964e20c78ec9af68bac8a4684fa1b86
Files
-
JaffaCakes118_4964e20c78ec9af68bac8a4684fa1b86.exe windows:6 windows x64 arch:x64
53ad616c7d72a97f5f3c31289f36fa85
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
EventWriteTransfer
EventRegister
EventUnregister
RegCreateKeyExW
RegOpenKeyExW
RegGetValueW
RegQueryValueExW
RegCloseKey
kernel32
FreeLibrary
LoadLibraryExW
GetModuleHandleW
SetErrorMode
VerSetConditionMask
VerifyVersionInfoW
MultiByteToWideChar
FileTimeToSystemTime
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
GetSystemTimeAsFileTime
TlsAlloc
FlsFree
TlsFree
FlsGetValue
TlsGetValue
FlsSetValue
TlsSetValue
GetCurrentProcessId
GetProcAddress
CloseHandle
RaiseException
GetCurrentProcess
TerminateProcess
GetModuleFileNameA
GetShortPathNameA
GetModuleFileNameW
FindResourceW
SizeofResource
LoadResource
IsWow64Process
WaitForSingleObjectEx
SetEvent
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
GetLastError
GetCurrentThreadId
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
ole32
CoRevokeClassObject
StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateGuid
CoRegisterClassObject
vcruntime140
__C_specific_handler
__std_exception_destroy
__std_exception_copy
wcsrchr
_purecall
__CxxFrameHandler3
memmove
__std_terminate
memset
memcmp
__C_specific_handler_noexcept
_CxxThrowException
memcpy
msvcp140
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
_Thrd_id
_Query_perf_counter
_Query_perf_frequency
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
_Thrd_sleep
_Xtime_get_ticks
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
__stdio_common_vsnwprintf_s
__p__commode
__stdio_common_vswprintf
_set_fmode
api-ms-win-crt-runtime-l1-1-0
_errno
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_set_app_type
_crt_atexit
_register_onexit_function
_initialize_onexit_table
terminate
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_narrow_environment
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_c_exit
_cexit
api-ms-win-crt-string-l1-1-0
strncpy_s
strcmp
strnlen
wcsncpy_s
wcsnlen
_stricmp
wcscmp
isdigit
wcsncat_s
wcscpy_s
api-ms-win-crt-convert-l1-1-0
_wtol
api-ms-win-crt-math-l1-1-0
pow
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
__initialize_lconv_for_unsigned_char
Sections
.text Size: 179KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 198KB - Virtual size: 197KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 154KB - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 404KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ