WinMail.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ea52d2c201a933b73f5873528af607b3_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ea52d2c201a933b73f5873528af607b3_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ea52d2c201a933b73f5873528af607b3_JaffaCakes118
-
Size
416KB
-
MD5
ea52d2c201a933b73f5873528af607b3
-
SHA1
3440badb444f8edc714a46c489d4c85094b0b82b
-
SHA256
a7f822bdb1d3162c8a3345ab877aeda063f86343fbd58907f5d201f02bc3c1dd
-
SHA512
b3369b5117a4c79269ca7a21fe1b05be7672f98a0805e51f323bfa8e0f54396a211c0ecc0d27d09a1e67664bef835afc3ba6bbd701872e65c8c0da27a9e0341f
-
SSDEEP
12288:gcDC+RN8T2v2sXdpRN8T2v2sXd41M2M+:gEnOsXdhnOsXd64+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea52d2c201a933b73f5873528af607b3_JaffaCakes118
Files
-
ea52d2c201a933b73f5873528af607b3_JaffaCakes118.exe windows:6 windows x64 arch:x64
b7522e1783b3ef674433699473b9f145
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
TraceEvent
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsA
UnregisterTraceGuids
RegCreateKeyExW
RegOpenKeyExW
RegSetValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
kernel32
GetProcAddress
lstrlenW
LoadLibraryA
FreeLibrary
ExpandEnvironmentStringsW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
CreateMutexW
ReleaseMutex
GetFileAttributesA
GetFileAttributesW
GetModuleHandleW
GetCurrentProcess
HeapSetInformation
SetConsoleCtrlHandler
GetVersionExA
SetFileAttributesW
DeleteFileW
GetShortPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
FindFirstFileW
FindNextFileW
FindClose
FindFirstFileExW
CreateDirectoryW
GetStartupInfoW
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GetLastError
GetModuleHandleA
SetUnhandledExceptionFilter
user32
UnhookWindowsHookEx
SetForegroundWindow
SendMessageTimeoutA
GetParent
GetLastActivePopup
GetPropW
SetWindowsHookExA
CallNextHookEx
AllowSetForegroundWindow
GetWindowThreadProcessId
FindWindowW
SendMessageW
GetGUIThreadInfo
IsDialogMessageW
SetPropW
IsChild
MessageBoxW
LoadStringW
msvcrt
memset
_vsnwprintf
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
msoert2
CopyRegistry
comctl32
ord344
ole32
OleInitialize
CoFreeUnusedLibraries
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoFreeAllLibraries
OleUninitialize
CoFreeUnusedLibrariesEx
shell32
SHCreateItemFromParsingName
SHGetSpecialFolderPathW
SHChangeNotify
SHGetSpecialFolderLocation
shlwapi
StrCmpW
PathAddExtensionW
ord158
PathRemoveBlanksW
PathCombineW
SHRegGetBoolUSValueA
SHDeleteKeyW
PathRemoveFileSpecW
PathAppendW
ord433
StrStrIW
SHRegGetValueA
PathFindFileNameW
StrCmpNIW
SHGetValueW
StrCmpIW
SHRegGetValueW
SHSetValueW
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 588B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 17B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 359KB - Virtual size: 358KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE