H:\PMS\_AUpdate\HanCapture\bin\Release\Agent.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f150d04a55649235966a873f49e801de_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f150d04a55649235966a873f49e801de_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f150d04a55649235966a873f49e801de_JaffaCakes118
-
Size
241KB
-
MD5
f150d04a55649235966a873f49e801de
-
SHA1
15b7dbe50b63f3573f8862816e431d022b3c91e9
-
SHA256
a91580d26e0187e7d4caeebce8eafa4881ad7714cdde03c75b5dc15683bd56a9
-
SHA512
33cbe93aa8ad7f4460c977f54514934c0c9ea3e92bdfdb0ba06ce9b9b098aa47f6daec93a41a4cfd37b138ab0bab7a8a61a4ec079ec351af0fba8996937f02d0
-
SSDEEP
3072:CZaJLbIOtG2IOQuuEK3piuGImP/7uxvNujW2UP75ioKueyCL9esEqdbNWM:CZatbIYbIOpKZiuGpuxvNVOueyCLZ5WM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f150d04a55649235966a873f49e801de_JaffaCakes118
Files
-
f150d04a55649235966a873f49e801de_JaffaCakes118.exe windows:5 windows x86 arch:x86
7cb0252cf7b6502b9765430bc5ac36bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
user32
MapWindowPoints
gdi32
SetViewportExtEx
advapi32
AdjustTokenPrivileges
shell32
ShellExecuteW
ws2_32
send
oleacc
LresultFromObject
winspool.drv
OpenPrinterW
oleaut32
VariantClear
Sections
.text Size: 211KB - Virtual size: 692KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE