C:\inetpub\Temp\2ve1qnkbqkp4beru51btl4dq35\Stub.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f94373753a510b3a44127230fb435c61_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f94373753a510b3a44127230fb435c61_JaffaCakes118
-
Size
392KB
-
MD5
f94373753a510b3a44127230fb435c61
-
SHA1
6b3157d8b119102de6b68033767ca396ee6efa90
-
SHA256
797f5ecd64f4cda8cc7a1018860ebcf937a7382681d64b4a1b6612124cb80d1d
-
SHA512
9db64d04f0c831f48948c2c6450e0266ea5e4d23e328de2a8e774a4a732447819ea540a95382186ab43fca86cf401e03dde8cebf9d97598f51eb1c1321d01f5e
-
SSDEEP
6144:tmBqEOTzSKweIs5sYvsYISpfIyEnuW12VCr7KOY8RZ7/HPIcawBhHrPz:tDEO5wHY8lyArEspxawBR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f94373753a510b3a44127230fb435c61_JaffaCakes118
Files
-
f94373753a510b3a44127230fb435c61_JaffaCakes118.exe windows:4 windows x86 arch:x86
2ae7a7414863cda0c10064d36b5f2ab2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetProcAddress
LoadLibraryA
VirtualFree
VirtualAlloc
GetCurrentProcess
lstrcatA
lstrcpynA
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
TerminateProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
HeapFree
RtlUnwind
InterlockedExchange
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
HeapReAlloc
IsBadWritePtr
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
GetSystemInfo
Sections
.text Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 328KB - Virtual size: 325KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ