ldifde.pdb
Behavioral task
behavioral1
Sample
f16866fbc8b4600e0f946f45f2d6c1d5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f16866fbc8b4600e0f946f45f2d6c1d5_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f16866fbc8b4600e0f946f45f2d6c1d5_JaffaCakes118
-
Size
179KB
-
MD5
f16866fbc8b4600e0f946f45f2d6c1d5
-
SHA1
95d15e1d0551ae04c6b0bd32a439ea260483b894
-
SHA256
aca83952d4f0c7cd9a181659e4efc3ec4fe8a62cf255d14c1a54e01737d9cc74
-
SHA512
c134cb754da2ae7118e335091f2af8cf9063fd685cbcba4a4bec51015d8478ab3644d0be8c5b3da64c8499b48d67c5339e0686e755bd53f8769d75822eb247d5
-
SSDEEP
3072:zjJYoRgFcvgOvST5Gl8wFIpdLz+eN+5ABZOsu7++G3VziBY3fTjVnHHZWkbP16x0:zBqT7LEp796zikJHgIPmIM6D
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f16866fbc8b4600e0f946f45f2d6c1d5_JaffaCakes118
Files
-
f16866fbc8b4600e0f946f45f2d6c1d5_JaffaCakes118.exe windows:5 windows x86 arch:x86
1c39fe18191cd8883f9bd4810c423506
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
fgetwc
fclose
towupper
_wtoi
iswdigit
_wcsicmp
wcscmp
vfwprintf
fwprintf
_wfopen
_vsnwprintf
??2@YAPAXI@Z
??3@YAXPAX@Z
_itow
malloc
_iob
fputwc
iswspace
wcslen
getc
_filelength
fread
perror
swscanf
wprintf
_except_handler3
wcscat
wcsstr
wcscpy
free
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LocalSize
LocalAlloc
MultiByteToWideChar
GetFileSizeEx
SetFilePointerEx
RaiseException
SetThreadUILanguage
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
LoadLibraryExW
LocalFree
GetFileType
WriteConsoleW
GetConsoleOutputCP
GetStdHandle
GetConsoleMode
SetConsoleMode
ReadConsoleW
FormatMessageW
ReadFile
CreateThread
InterlockedExchange
WaitForMultipleObjects
GetExitCodeThread
InterlockedIncrement
Sleep
EnterCriticalSection
LeaveCriticalSection
GetSystemInfo
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
DeleteFileW
GetTempPathW
GetTempFileNameW
CreateFileW
WideCharToMultiByte
GetLastError
WriteFile
wldap32
ord214
ord14
ord88
ord145
ord159
ord36
ord167
ord127
ord190
ord79
ord77
ord73
ord97
ord133
ord53
ord42
ord62
ord105
ord108
ord149
ord152
ord21
ord40
ord18
ord13
ord29
ord142
ord194
ord12
ord41
ord140
ord26
ord208
ord147
ord224
ord179
ord135
ord16
ord206
ord27
ord191
ord118
urlmon
URLDownloadToFileW
user32
wsprintfW
netapi32
NetApiBufferFree
DsGetDcNameW
ntdll
wcsncat
iswctype
towlower
qsort
swprintf
_wcsnicmp
RtlEnumerateGenericTable
RtlDeleteElementGenericTable
RtlIsGenericTableEmpty
RtlInitializeGenericTable
RtlLookupElementGenericTable
RtlNumberGenericTableElements
RtlInsertElementGenericTable
_allmul
Sections
.text Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE