C:\chromium_57.0.2987.110\src\out\Release\initialexe\chrome.exe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
15b8a8e5541eeff41bc1f0497c742198_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
15b8a8e5541eeff41bc1f0497c742198_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
15b8a8e5541eeff41bc1f0497c742198_JaffaCakes118
-
Size
809KB
-
MD5
15b8a8e5541eeff41bc1f0497c742198
-
SHA1
311c7814807bb725eb0383b4ec3a83fe6be9dc82
-
SHA256
b4a8d0fba02d457bf433a694c5e66bd86ce87fc5bc9a9965cbb84e8693a34159
-
SHA512
193e926b5f4e1c9ad8d0f139696c104372c17febfd0cf7776b15ce71d88602d1a2d77c22fc2a4f857d09785f90c2d542740845f8110de811d646461f6d2d5169
-
SSDEEP
24576:jmEAnyk3rX/1f+zr1VzET2V3WtGgC6Kcw:iESZWzMTUG0gCx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15b8a8e5541eeff41bc1f0497c742198_JaffaCakes118
Files
-
15b8a8e5541eeff41bc1f0497c742198_JaffaCakes118.exe windows:5 windows x86 arch:x86
840f6367ab067286ab83d738143e48e7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
chrome_elf
GetInstallDetailsPayload
SignalChromeElf
SignalInitializeCrashReporting
advapi32
ImpersonateNamedPipeClient
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
SystemFunction036
OpenProcessToken
GetAce
GetKernelObjectSecurity
GetLengthSid
GetSecurityDescriptorSacl
SetKernelObjectSecurity
SetTokenInformation
SetSecurityInfo
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RevertToSelf
RegDisablePredefinedCache
CopySid
CreateWellKnownSid
CreateRestrictedToken
DuplicateToken
DuplicateTokenEx
EqualSid
GetTokenInformation
LookupPrivilegeValueW
CreateProcessAsUserW
SetThreadToken
ConvertSidToStringSidW
SetEntriesInAclW
GetSecurityInfo
kernel32
GetThreadContext
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetLastError
SetLastError
CreateEventW
GetCurrentThreadId
DuplicateHandle
WaitForSingleObject
GetCurrentProcess
GetProcessId
SetCurrentDirectoryW
SetProcessShutdownParameters
LoadLibraryExW
VirtualAlloc
VirtualFree
MultiByteToWideChar
WideCharToMultiByte
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
WriteFile
CreateFileW
DeleteFileW
CloseHandle
GetLocalTime
GetCurrentDirectoryW
GetCurrentProcessId
FormatMessageA
GetTickCount
Sleep
FileTimeToSystemTime
QueryPerformanceFrequency
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCommandLineW
LocalFree
GetModuleHandleW
ExpandEnvironmentStringsW
GetVersionExW
GetNativeSystemInfo
TerminateProcess
OpenProcess
GetExitCodeProcess
ReadFile
GetFileSizeEx
SetEndOfFile
GetFileInformationByHandle
SetFilePointerEx
FlushFileBuffers
GetSystemInfo
GetProcessTimes
VirtualQueryEx
GetThreadId
IsDebuggerPresent
RaiseException
CreateThread
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateDirectoryW
QueryDosDeviceW
GetLongPathNameW
RemoveDirectoryW
GetTempPathW
GetFileAttributesW
UnmapViewOfFile
SetFileAttributesW
ReplaceFileW
GetTempFileNameW
CreateFileMappingW
GetThreadLocale
MoveFileW
RegisterWaitForSingleObject
UnregisterWaitEx
GetUserDefaultLangID
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
HeapSetInformation
GetModuleHandleExW
FindFirstFileW
FindFirstFileExW
FindNextFileW
FindClose
SizeofResource
LockResource
LoadResource
FindResourceW
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
VirtualQuery
LoadLibraryW
SetEvent
ResetEvent
SetInformationJobObject
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
CompareStringW
DecodePointer
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetSystemDirectoryW
GetWindowsDirectoryW
GetEnvironmentVariableW
SetEnvironmentVariableW
OutputDebugStringW
GetComputerNameExW
FreeLibrary
LockFileEx
UnlockFileEx
GetFileType
VirtualAllocEx
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateJobObject
GetUserDefaultLCID
WriteProcessMemory
AssignProcessToJobObject
SetHandleInformation
ProcessIdToSessionId
GetProcessHandleCount
SignalObjectAndWait
CreateMutexW
VirtualProtectEx
QueryFullProcessImageNameW
VirtualFreeEx
CreateJobObjectW
CreateNamedPipeW
CreateRemoteThread
ReadProcessMemory
DebugBreak
lstrlenW
SearchPathW
VirtualProtect
LoadLibraryExA
SuspendThread
CreateSemaphoreW
ReleaseSemaphore
GetVersion
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
GetFileInformationByHandleEx
DisconnectNamedPipe
ConnectNamedPipe
GetUserDefaultUILanguage
ResumeThread
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
WriteConsoleW
EnumSystemLocalesW
IsValidLocale
ReadConsoleW
GetACP
GetStdHandle
SetStdHandle
GetFullPathNameW
ExitProcess
GetConsoleMode
GetConsoleCP
PeekNamedPipe
GetDriveTypeW
RtlUnwind
GetCPInfo
GetLocaleInfoW
LCMapStringW
EncodePointer
GetStringTypeW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetSystemDefaultLCID
MapViewOfFile
CreateProcessW
psapi
GetMappedFileNameW
shell32
SHGetFolderPathW
SHGetKnownFolderPath
CommandLineToArgvW
user32
GetUserObjectInformationW
GetProcessWindowStation
SetProcessWindowStation
CreateWindowStationW
GetThreadDesktop
CreateDesktopW
CloseWindowStation
CloseDesktop
wsprintfW
GetWindowThreadProcessId
AllowSetForegroundWindow
IsWindow
SendMessageTimeoutW
FindWindowExW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
winhttp
WinHttpReadData
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpOpen
WinHttpConnect
WinHttpCloseHandle
Exports
Exports
GetHandleVerifier
IsSandboxedProcess
Sections
.text Size: 526KB - Virtual size: 525KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 173KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ