extexport.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d7ce77951a71d6e2a581c5d89b06937f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
d7ce77951a71d6e2a581c5d89b06937f_JaffaCakes118
-
Size
447KB
-
MD5
d7ce77951a71d6e2a581c5d89b06937f
-
SHA1
1f1f459085fd8eee9b7e4ee3a3ac46a3e6945b88
-
SHA256
8d0de7f3bfe914366feb6ec911e4985001389eff5167a79bea2a6e8a16f78b1b
-
SHA512
13719188f63fc089ae78fdd8ccbffe6f412618e5c85ee28c2237861daa083b2ac7c8d613d449a901fc90b19709e6018f55f5c2b55fbe0d6858e079e19cf6d27d
-
SSDEEP
12288:hNzyGMPS7dMoKxN5Cpf/0ps/49puGQW56FPbfZ1KBwA:hNrMydVKxGpX0pTIA6FzHKBwA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d7ce77951a71d6e2a581c5d89b06937f_JaffaCakes118
Files
-
d7ce77951a71d6e2a581c5d89b06937f_JaffaCakes118.exe windows:10 windows x64 arch:x64
656e242b4145a30f282c9654e8db468c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
kernel32
IsDebuggerPresent
DebugBreak
LocalFree
CreateMutexExW
OpenSemaphoreW
GetVersionExA
OutputDebugStringW
FormatMessageW
ReleaseMutex
LocalAlloc
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
CreateSemaphoreExW
GetModuleFileNameA
VirtualAlloc
DecodePointer
GetProcessHeap
HeapAlloc
InitOnceExecuteOnce
lstrcmpW
CloseHandle
CreateFileW
WriteFile
LoadLibraryExW
FreeLibrary
GetProcAddress
GetLastError
ExpandEnvironmentStringsW
WaitForSingleObjectEx
Sleep
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
DeleteFileW
MoveFileW
CreateDirectoryW
GetModuleFileNameW
HeapFree
msvcrt
_itow_s
_callnewh
_vsnwprintf
free
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
__C_specific_handler
wcsncmp
wcschr
iswalpha
memcpy_s
rand_s
_wcsicmp
exit
_exit
_cexit
__setusermatherr
malloc
_initterm
memset
ole32
IIDFromString
CoTaskMemRealloc
CoTaskMemFree
shlwapi
StrStrW
StrCmpNIW
ord215
StrStrIW
PathFindFileNameW
ord158
PathFileExistsW
StrCmpNW
user32
LoadStringW
shell32
SHGetFolderPathAndSubDirW
SHSetLocalizedName
iertutil
ord672
ord675
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 396KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ