C:\tuxugizevimebo goyuc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
edf4baab2aa3690c400a9aeac06e8d02_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
edf4baab2aa3690c400a9aeac06e8d02_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
edf4baab2aa3690c400a9aeac06e8d02_JaffaCakes118
-
Size
11.7MB
-
MD5
edf4baab2aa3690c400a9aeac06e8d02
-
SHA1
dc6571a5a163834d73b9fcf1653ccc764e5d7d17
-
SHA256
b5b8abbb22c34e7295155b18891c54bc390c4defd84e1505980b11560a4c13f3
-
SHA512
5a924437ca285537a733714336b8e20b4c3708f39c1ff603c10780768f8799c630156db289cbfe0e3578411beccf0cc284e1dc7dcb87112de6e1d7e24a53c05b
-
SSDEEP
49152:hxtpvuMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMc:v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource edf4baab2aa3690c400a9aeac06e8d02_JaffaCakes118
Files
-
edf4baab2aa3690c400a9aeac06e8d02_JaffaCakes118.exe windows:5 windows x86 arch:x86
584a56b00988b3dc7b348134f62624d6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCommandLineA
TlsSetValue
GetCalendarInfoW
GetCalendarInfoA
SetVolumeMountPointA
GetFileAttributesA
WritePrivateProfileStructW
FindNextVolumeW
SetTimeZoneInformation
IsBadWritePtr
GetGeoInfoA
GetShortPathNameA
GetConsoleOutputCP
GetFileSizeEx
InterlockedFlushSList
GetCurrentDirectoryW
GetThreadLocale
GetLongPathNameA
IsBadHugeWritePtr
CreateTimerQueueTimer
HeapUnlock
GetFirmwareEnvironmentVariableW
LockFileEx
EnumTimeFormatsW
EnterCriticalSection
SetTimerQueueTimer
DefineDosDeviceA
PrepareTape
GetAtomNameA
LoadLibraryA
OpenMutexA
CreateSemaphoreW
LocalAlloc
GetExitCodeThread
OpenEventA
GetCommMask
AddAtomA
OpenJobObjectW
GetModuleHandleA
CancelTimerQueueTimer
VirtualProtect
OutputDebugStringA
SetProcessShutdownParameters
CloseHandle
GetVolumeNameForVolumeMountPointW
lstrcpyA
GetCompressedFileSizeW
SetFileTime
FormatMessageA
GetPrivateProfileStringW
GetTickCount
FreeEnvironmentStringsA
GetFileAttributesExA
GetSystemDefaultLCID
SetThreadExecutionState
ScrollConsoleScreenBufferW
UpdateResourceA
SetEndOfFile
GetDriveTypeW
GetConsoleAliasExesA
lstrlenA
HeapCompact
GetFullPathNameW
CreateTimerQueue
SetComputerNameA
ReadConsoleW
ReadFile
CreateFileW
WriteConsoleW
OutputDebugStringW
WideCharToMultiByte
EncodePointer
DecodePointer
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetStringTypeW
GetLastError
HeapFree
GetCommandLineW
GetCPInfo
RaiseException
RtlUnwind
HeapAlloc
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsDebuggerPresent
GetProcessHeap
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
GetStdHandle
GetFileType
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
SetStdHandle
FlushFileBuffers
advapi32
ConvertToAutoInheritPrivateObjectSecurity
GetSecurityDescriptorDacl
FindFirstFreeAce
QueryServiceConfigA
ObjectDeleteAuditAlarmA
GetSidLengthRequired
RegSaveKeyA
EnumServicesStatusW
RegConnectRegistryW
RegOpenKeyExA
CreatePrivateObjectSecurity
GetOldestEventLogRecord
RegQueryValueExA
RegisterServiceCtrlHandlerA
AccessCheckByTypeResultListAndAuditAlarmA
StartServiceCtrlDispatcherA
InitiateSystemShutdownA
CreateServiceW
winhttp
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpQueryOption
WinHttpReadData
Sections
.text Size: 260KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 782KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11.4MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ