powershell.pdb
Static task
static1
General
-
Target
JaffaCakes118_232d6b629e6ad3eecc5c84417e98c48e
-
Size
816KB
-
MD5
232d6b629e6ad3eecc5c84417e98c48e
-
SHA1
03defd5c1e5a33b4787be622a2e69122bda3b214
-
SHA256
f1f2c7ae0fcd218b99c62e2e85899000fb567b0214a6c6c45c70656b4231a9e2
-
SHA512
f27b990d4758378886119ed195884ede387993e2d1592e136ff7b69ccfbd48c072e12c380cb3a50eb34be8cccd3aab9358e012bbe1e2f0f3bf2e6dc21154ae66
-
SSDEEP
12288:SJW2KXzJ4pdd3klnnWosPhnzqIoB8UJVr5NdTf55L9fLHGXM:SJW2KjJ4Td3kJnbsPhnzqNBBVXdPhq8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_232d6b629e6ad3eecc5c84417e98c48e
Files
-
JaffaCakes118_232d6b629e6ad3eecc5c84417e98c48e.exe windows:10 windows x86 arch:x86
d1a922c94a1f407cb2bbcad033c8ed7a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
_initterm
_controlfp
_except_handler4_common
_vsnwprintf
_wcsicmp
_wcsnicmp
bsearch
memcpy
_wfopen
_itow_s
wcstoul
??0exception@@QAE@ABQBD@Z
wcschr
memmove_s
__uncaught_exception
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
malloc
wcsncmp
wcsrchr
free
_purecall
memcpy_s
__CxxFrameHandler3
fclose
memcmp
memset
atl
ord30
kernel32
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
MapViewOfFile
CreateFileMappingW
FreeLibrary
LoadResource
FindResourceExW
UnmapViewOfFile
GetVersionExW
GetProcAddress
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SearchPathW
SetErrorMode
VerifyVersionInfoW
GetTickCount
GetSystemTimeAsFileTime
EnterCriticalSection
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocaleInfoW
GetStartupInfoW
SleepConditionVariableSRW
FindFirstFileW
LeaveCriticalSection
CompareStringW
SetConsoleTitleW
SetLastError
VerSetConditionMask
GetCurrentProcess
GetStdHandle
WriteFile
WakeAllConditionVariable
ExpandEnvironmentStringsW
LocalFree
WriteConsoleW
AcquireSRWLockExclusive
SetThreadUILanguage
GetCurrentThreadId
GetModuleHandleW
FindClose
CreateFileW
GetFileAttributesW
FormatMessageW
ReleaseSRWLockExclusive
Sleep
GetLastError
CloseHandle
IsWow64Process
GetFileType
oleaut32
VariantClear
SysFreeString
SysAllocString
SafeArrayPutElement
SysStringLen
SafeArrayCreate
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegGetValueW
RegEnumKeyExW
ole32
CoInitializeEx
PropVariantClear
CoInitialize
CoTaskMemAlloc
CoUninitialize
CoCreateInstance
user32
LoadStringW
mscoree
CorBindToRuntimeEx
Sections
.text Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 351KB - Virtual size: 351KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 400KB - Virtual size: 992KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ