C:\jizug-memopebi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f56ce0db616131aab23985d13dfd55f4_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f56ce0db616131aab23985d13dfd55f4_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f56ce0db616131aab23985d13dfd55f4_JaffaCakes118
-
Size
10.7MB
-
MD5
f56ce0db616131aab23985d13dfd55f4
-
SHA1
53bedf97c325b3d0ec987dece302cf66e52e2ff3
-
SHA256
9737872b02523817b0be8bdcae4c70ec3477c5f7ef4a6ec35b5c45f29f0b2980
-
SHA512
b29d4a8328aedb8f30bd7758ba278ffacab1fc942db747639074d8ac5e87f5c40024412a1dbe75a8ebcfd7a410ad5dde022a1825f7c2558e1949928e8420b34e
-
SSDEEP
12288:AdY3RyLHWIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIP:AwyD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f56ce0db616131aab23985d13dfd55f4_JaffaCakes118
Files
-
f56ce0db616131aab23985d13dfd55f4_JaffaCakes118.exe windows:5 windows x86 arch:x86
cb2a40c38edf22fab52fb5d5fabcb699
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
InterlockedExchangeAdd
CreateActCtxW
WriteConsoleInputA
GetConsoleAliasesA
WriteConsoleA
SetLastError
BuildCommDCBW
WriteProfileSectionA
GetLongPathNameA
SetEvent
CancelDeviceWakeupRequest
GetCPInfo
PulseEvent
CreateIoCompletionPort
GetGeoInfoA
VirtualProtect
GetProcAddress
GetModuleHandleW
HeapLock
HeapQueryInformation
GetOEMCP
CreateMutexA
WaitForSingleObject
GetAtomNameA
CreateJobObjectW
SetWaitableTimer
HeapCompact
MultiByteToWideChar
HeapAlloc
GetStartupInfoW
GetLastError
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
DeleteCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CloseHandle
CreateFileA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetACP
IsValidCodePage
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
ReadFile
HeapSize
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 39.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10.5MB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ