d:\bld\nvr90\apps\NVCoInst\objfre\i386\nvcoinst.pdb
Static task
static1
General
-
Target
JaffaCakes118_b5220a30fad4185b6b4969e838c790cf
-
Size
157KB
-
MD5
b5220a30fad4185b6b4969e838c790cf
-
SHA1
ae2f370f929c3089e0d440b9fefcee6e2c555f3d
-
SHA256
d84b4301a469dbd0f9d0851d1998e6e76ce1f871bbaf720f741951dfc5fafa21
-
SHA512
843259e6d2be72ee6909ea7d76f403944741954f4110eec1b5a70f328753977079a796e87b1ea8f4b7a8e96dde4f1b64cd767e2bc3fe4819f448fe0d241fdfcd
-
SSDEEP
3072:/n1Xz8Wch7IY4JHsVngTWghW29yqlO4qNnji9YdZ4t3DS2c:/d4UBqngTnWglGNjIYdytTSv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_b5220a30fad4185b6b4969e838c790cf
Files
-
JaffaCakes118_b5220a30fad4185b6b4969e838c790cf.dll windows:5 windows x86 arch:x86
453f070168050bbf0e4a1dc1ddce2380
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntdll
RtlUnwind
advapi32
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
kernel32
LCMapStringW
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
CopyFileW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetFullPathNameW
GetLastError
SetFileAttributesW
GetFileAttributesW
Process32NextW
Module32FirstW
Process32FirstW
CreateToolhelp32Snapshot
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
RemoveDirectoryW
DeleteFileW
MoveFileExW
CreateDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetWindowsDirectoryW
ExitProcess
GetModuleHandleA
SetFilePointer
GetStdHandle
WriteFile
MultiByteToWideChar
LCMapStringA
WideCharToMultiByte
GetOEMCP
SetStdHandle
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetLocaleInfoA
GetCPInfo
GetStringTypeA
GetStringTypeW
VirtualFree
HeapReAlloc
FlushFileBuffers
GetModuleFileNameA
LoadLibraryA
GetACP
lz32
LZOpenFileW
LZClose
LZCopy
setupapi
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupDiGetDeviceRegistryPropertyW
SetupCloseInfFile
SetupDiGetDriverInfoDetailW
SetupFindFirstLineW
SetupOpenInfFileW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
Exports
Exports
NVCoInstaller
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 122KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE