o:\out_Win32\Release\avp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ea63882060533e02e4f73f96bd9dc31d_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
ea63882060533e02e4f73f96bd9dc31d_JaffaCakes118
-
Size
416KB
-
MD5
ea63882060533e02e4f73f96bd9dc31d
-
SHA1
c7a02c8701169d3bf92e61caf40aede6a68f544d
-
SHA256
5e67c99a776d38d001c02d8c707b4d1953d8ebc3391ebd1575f5d7775bad6ee5
-
SHA512
32688b35291da00c4682b05f4bb3ef17db6f0e9bf8978ccf7546e130e4e7c5eb973d4b4b16c184186ec7b7b563a9c616702ae3461e5797d1bbf66e6166005afe
-
SSDEEP
6144:bpc0Faj9dkuPjQFy3tqxJyb6/QxzmasyoYDXvAQAOa4jhJPaL+jdJSI:TF4kuPjQFGMQlOyoYDXv5zSijeI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea63882060533e02e4f73f96bd9dc31d_JaffaCakes118
Files
-
ea63882060533e02e4f73f96bd9dc31d_JaffaCakes118.exe windows:4 windows x86 arch:x86
758aa55e886ec603bc7f2b4b07c9b1fa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
HeapAlloc
GetProcessHeap
HeapFree
TerminateProcess
GetCurrentProcess
SuspendThread
ResumeThread
OpenThread
GetCurrentThreadId
GetCurrentProcessId
FreeLibrary
GetProcAddress
LoadLibraryA
FlushFileBuffers
CloseHandle
WriteFile
CreateFileW
LoadLibraryW
WaitForSingleObject
ReleaseMutex
lstrcpynA
GetModuleFileNameA
GetComputerNameA
lstrlenA
GetExitCodeProcess
GetDiskFreeSpaceExA
GetDriveTypeA
GetCommandLineW
GetModuleHandleA
OutputDebugStringA
CreateMutexW
OpenMutexW
GetModuleFileNameW
GetVersionExA
GetFileType
GetStdHandle
CreateThread
CreateMutexA
OpenMutexA
OpenEventA
GetLastError
CreateEventA
ExpandEnvironmentStringsW
MultiByteToWideChar
GetPrivateProfileStringW
GetPrivateProfileIntW
FindClose
FindFirstFileW
CreateProcessW
Sleep
SetProcessAffinityMask
SetErrorMode
InitializeCriticalSection
DeleteCriticalSection
lstrcpyA
LeaveCriticalSection
SetEvent
EnterCriticalSection
SetHandleInformation
SetProcessWorkingSetSize
FreeConsole
SetConsoleCtrlHandler
lstrcatA
ExpandEnvironmentStringsA
GetTickCount
LocalFree
FormatMessageA
SetConsoleMode
GetConsoleMode
SetConsoleTitleA
AllocConsole
CreateProcessA
GetThreadContext
GetCurrentThread
SetConsoleCursorPosition
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
GetFileAttributesA
WaitForMultipleObjects
GetFullPathNameA
GetFullPathNameW
WideCharToMultiByte
DeleteFileW
GetTempFileNameW
CreateDirectoryW
GetTempPathW
lstrlenW
GetVersion
GetLocalTime
CreateSemaphoreA
ReleaseSemaphore
VirtualAlloc
VirtualFree
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
LocalAlloc
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
RaiseException
InterlockedCompareExchange
InterlockedExchange
msvcr80
??0exception@std@@QAE@XZ
__CxxFrameHandler3
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
_invalid_parameter_noinfo
strrchr
wcsrchr
_mbschr
_mbsicmp
_mbsnbicmp
??0exception@std@@QAE@ABQBDH@Z
memset
printf
_getch
sprintf
_wmakepath
_wsplitpath
_set_error_mode
malloc
free
_beginthreadex
__argc
__argv
_itoa
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
setlocale
_mbslen
??_U@YAPAXI@Z
??_V@YAXPAX@Z
setvbuf
_fdopen
_open_osfhandle
__iob_func
_ismbblead
strcpy_s
_localtime32
fflush
fprintf
_vsnprintf
strerror
_errno
fopen
_snprintf
getchar
memmove_s
getc
fclose
fgets
_flushall
sscanf
_splitpath
wcsncat_s
wcsncpy_s
_snwprintf_s
sscanf_s
strchr
_snprintf_s
swscanf
strncmp
_mbscmp
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
atoi
_set_invalid_parameter_handler
_time32
memmove
memcpy
?what@exception@std@@UBEPBDXZ
Sections
.text Size: 228KB - Virtual size: 225KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.2rdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE