t:\access\x86\ship\0\msaccess.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0ee9ea3b831677df1ccde2eaafacd165_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0ee9ea3b831677df1ccde2eaafacd165_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0ee9ea3b831677df1ccde2eaafacd165_JaffaCakes118
-
Size
55KB
-
MD5
0ee9ea3b831677df1ccde2eaafacd165
-
SHA1
6efd210c94ef5d49de0f705931b9e93b37e688fb
-
SHA256
13397ce53d5bcc5339a9e5b83144eed11e051666abcf26ad393505cfd82ee9ea
-
SHA512
6f32112eb5a8c7604952c1d464b5531a0dcef244f5451729f169430dde2fd15c497c57c0f46f56e69d88ac99cfb22c65e9cf7ca8c724c7451c99cffed5ad2105
-
SSDEEP
768:k15t58eaE9w2/IpNCZga/W155ocNooVr+nY///////////////////////////q1:k15809apNwjaXnyoVrWlIP9EQiTSS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ee9ea3b831677df1ccde2eaafacd165_JaffaCakes118
Files
-
0ee9ea3b831677df1ccde2eaafacd165_JaffaCakes118.exe windows:4 windows x86 arch:x86
2bed3b575b122ce7042753fe75b3b7d0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
ExitProcess
FormatMessageA
GetLastError
SetLastError
VirtualAlloc
CloseHandle
MapViewOfFile
CreateFileMappingA
VirtualFree
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
GetModuleFileNameA
GetModuleFileNameW
SetEnvironmentVariableW
SetEnvironmentVariableA
WideCharToMultiByte
UnmapViewOfFile
lstrcpynW
GetFullPathNameW
GetFullPathNameA
HeapAlloc
GetProcessHeap
GetFileSize
ReadFile
SetFilePointer
CreateFileW
GetEnvironmentVariableW
CreateFileA
GetEnvironmentVariableA
GetVersion
user32
MessageBoxA
Exports
Exports
@EnumFree@4
@EnumInit@4
@EnumObject@20
@EnumXlateListSep@8
@EnumXlateOp@12
@FControlNameConflict@8
@FEnumFuncParams@24
@FGetDlgHelp@12
@FIsSubOfObject@4
@FReallocExpBuffer@8
@FreeEnumObject@8
@GetPasteSectionName@12
@GetStringOfId@16
@GetSubControlName@8
@ObjtypFromDwObj@4
AccWizExtTextOutU@32
AccessLoadString@16
ActidOfHscr@4
CloseHscr@4
ComboTypOfActidIarg@8
CreateIExprSrvObj
DllGetLCID
FCommitIMEString@4
FDeliverDb@16
FGetHintLogfont@4
FNextHscr@12
FUniqueIndexTableFieldEx@8
FillADT@4
GetHFontDialog@0
GetHyperLinkObject@12
GetLCID@0
IRunCommandIdFromDMIArgs@20
IdsArgNameOfActidIarg@8
IdsComboFillOfActidIarg@8
JETESLoadProjectTypeLib
MSAU_CreateSystemDatabase@20
MSAU_ErrCloseRegKey@4
MSAU_ErrDeleteRegKey@8
MSAU_ErrDeleteRegValue@8
MSAU_ErrGetRegKey@20
MSAU_ErrGetRegKeyInfo@16
MSAU_ErrGetRegVal@20
MSAU_ErrGetRegValName@24
MSAU_ErrOpenRegKeyEx@20
MSAU_ErrSortDbobjArray@8
MSAU_ErrSortStringArray@4
MSAU_ErrWriteRegKey@12
MSAU_ErrWriteRegVal@20
MSAU_FRandomPid@8
MSAU_FillInHashValues@20
MSAU_GetFileName@8
MSAU_GetSizeCount@8
MSAU_GetSizeList@12
MSAU_OfficeGetFileName@8
MSAU_OfficeGetTcDIB@12
MidEastSupport@0
ParseHyperlinkC@36
SetEnumIntlView@4
SizeCallback@8
WizChooseColor@8
Sections
.text Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.res Size: 45KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 160B - Virtual size: 10.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE