C:\gon11\xahoyivavonayilene3\focesorefat12_sicomoyuje ju.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f2d6bac2f4208d668b547848b5b846a6_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f2d6bac2f4208d668b547848b5b846a6_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f2d6bac2f4208d668b547848b5b846a6_JaffaCakes118
-
Size
12.2MB
-
MD5
f2d6bac2f4208d668b547848b5b846a6
-
SHA1
1dc64444c82eb91d175bd0490eb5147c959a5dca
-
SHA256
b2eb1eeaf6d84c8e877b366a85c7834453c04e63c0c027b0e014c62e42b69f07
-
SHA512
2efb885ca1f37d7789d6545d91ac50102f29179c84fef558e1a8655b50ba8b17eeb6d17019e535b4bed91a9841812c5701f8a6d497a652c2ed00b4506ae9146d
-
SSDEEP
49152:w7JggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggI:
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f2d6bac2f4208d668b547848b5b846a6_JaffaCakes118
Files
-
f2d6bac2f4208d668b547848b5b846a6_JaffaCakes118.exe windows:5 windows x86 arch:x86
eb2409931607875e59e6f5b3470fa923
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCommandLineA
GetProcessTimes
SetHandleCount
TlsSetValue
SetFileShortNameW
GetFirmwareEnvironmentVariableA
GetThreadSelectorEntry
GetCalendarInfoW
FormatMessageW
GetFileAttributesA
GetComputerNameExA
WritePrivateProfileStructW
GetTimeFormatW
FindNextVolumeW
SetTimeZoneInformation
LocalReAlloc
IsBadWritePtr
GetGeoInfoA
CreateActCtxA
GetShortPathNameA
GetConsoleOutputCP
GetFileSizeEx
InterlockedFlushSList
GetCurrentDirectoryW
GetLongPathNameW
GetThreadLocale
IsBadHugeWritePtr
BackupWrite
DefineDosDeviceW
CreateTimerQueueTimer
SetComputerNameA
EnterCriticalSection
EnumTimeFormatsA
PrepareTape
GetAtomNameA
LoadLibraryA
OpenMutexA
CreateSemaphoreW
LocalAlloc
GetExitCodeThread
LockResource
AddAtomW
OpenEventA
HeapLock
GetCommMask
OpenJobObjectW
EnumDateFormatsA
lstrcmpiW
GetModuleHandleA
CancelTimerQueueTimer
VirtualProtect
OpenEventW
OutputDebugStringA
SetProcessShutdownParameters
_lopen
CloseHandle
GetVolumeNameForVolumeMountPointW
lstrcpyA
CreateFileW
ReadConsoleW
ReadFile
WriteConsoleW
OutputDebugStringW
GetCompressedFileSizeW
SetFileTime
FormatMessageA
GetPrivateProfileStringW
SetThreadUILanguage
FreeEnvironmentStringsA
GetSystemDefaultLCID
GetFullPathNameW
LockFile
UpdateResourceA
LoadResource
FindResourceExW
SetEndOfFile
GetDriveTypeW
GetConsoleAliasExesA
CopyFileExW
WritePrivateProfileStructA
lstrlenA
HeapCompact
CreateTimerQueue
DisableThreadLibraryCalls
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
LeaveCriticalSection
DeleteCriticalSection
IsProcessorFeaturePresent
GetLastError
HeapFree
GetCommandLineW
GetCPInfo
RaiseException
RtlUnwind
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsDebuggerPresent
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetProcessHeap
GetStdHandle
GetFileType
GetCurrentThreadId
HeapSize
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
LoadLibraryExW
user32
SetClassLongA
GetWindowWord
GetMonitorInfoA
EnumClipboardFormats
advapi32
LookupPrivilegeNameA
AccessCheckByTypeResultListAndAuditAlarmW
ConvertToAutoInheritPrivateObjectSecurity
RegConnectRegistryA
GetUserNameA
QueryServiceConfigA
RegSaveKeyA
RegOpenKeyExA
GetNumberOfEventLogRecords
ObjectDeleteAuditAlarmW
RegQueryValueExW
EqualSid
RegisterServiceCtrlHandlerA
EnumServicesStatusA
ObjectPrivilegeAuditAlarmA
SetThreadToken
LookupPrivilegeNameW
GetSidIdentifierAuthority
InitiateSystemShutdownA
CreateServiceW
winhttp
WinHttpConnect
WinHttpCloseHandle
WinHttpSetStatusCallback
WinHttpSetOption
Sections
.text Size: 250KB - Virtual size: 250KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11.9MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ