G:\Making\persisted\authorizationS.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1c101db2daf76a3fd49172ed7855abfe_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1c101db2daf76a3fd49172ed7855abfe_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
1c101db2daf76a3fd49172ed7855abfe_JaffaCakes118
-
Size
562KB
-
MD5
1c101db2daf76a3fd49172ed7855abfe
-
SHA1
fdcb04aeef75df5b7c5635054654292d893e4dd9
-
SHA256
1dd0bf89c416a276deb5bba33d65a8a0c5a5653e4f9d3178d6745313b1416f81
-
SHA512
3ead35c9dba09e421359f4eed7cbf92b0e7f46920f88fb5e62be13051476efaf3ca722786c960c2095b9813268eefdce3196e8b8ce15f21c81a887738fb6f1f9
-
SSDEEP
12288:nxibnc/66oWkCd5JGtsu8e4DTUqwJSGDnzQcle4ySC7swBOZxQ:x6i6jl45JWsuN4HwQ8byF73OZW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1c101db2daf76a3fd49172ed7855abfe_JaffaCakes118
Files
-
1c101db2daf76a3fd49172ed7855abfe_JaffaCakes118.exe windows:5 windows x86 arch:x86
c6a7391f36afb0f36c16d13723e46f36
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB Paths
Imports
kernel32
SetFilePointer
ReadFile
WriteFile
ExitProcess
IsProcessorFeaturePresent
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
GetProcAddress
GetCurrentThreadId
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetConsoleCP
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCPInfo
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
RtlUnwind
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DecodePointer
EncodePointer
InterlockedDecrement
InterlockedIncrement
FlushFileBuffers
GetConsoleMode
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
LoadLibraryW
SetStdHandle
WriteConsoleW
FindResourceW
CloseHandle
CreateToolhelp32Snapshot
GetSystemInfo
LocalAlloc
GlobalFree
SetLastError
GetLastError
GetModuleFileNameW
Thread32Next
LocalReAlloc
HeapCreate
Sleep
Thread32First
GetCurrentProcess
HeapAlloc
LoadResource
IsDebuggerPresent
CreateFileW
user32
UpdateLayeredWindow
GetWindowRect
DispatchMessageW
GetWindow
GetMessageW
IsIconic
FillRect
DrawTextA
LoadStringA
GetParent
AttachThreadInput
GetClientRect
SendMessageA
CreateIconIndirect
GetIconInfo
GetDC
TranslateMessage
GetMenu
GetWindowTextA
SetWindowLongA
InvalidateRect
CreateWindowExA
ReleaseDC
GetDlgItem
DefWindowProcA
GetDesktopWindow
SetWindowPos
GetMenuItemInfoA
CheckDlgButton
LoadAcceleratorsA
DeferWindowPos
GetSystemMetrics
IsWindowVisible
UpdateWindow
SetMenuItemInfoA
SetWindowTextW
DestroyIcon
EndDeferWindowPos
gdi32
DeleteObject
SelectObject
CreateCompatibleDC
Rectangle
StartDocA
GetTextExtentPointA
Escape
SetROP2
SetPixelFormat
SetBkMode
GetObjectA
EndDoc
GetStockObject
CreateSolidBrush
CreateFontIndirectA
CreateDIBSection
DeleteDC
SetTextColor
StartPage
EndPage
SetStretchBltMode
advapi32
OpenProcessToken
RegOpenKeyExW
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
LookupPrivilegeValueA
comctl32
InitCommonControlsEx
gdiplus
GdipDeleteGraphics
GdipCreateFromHDC
secur32
InitSecurityInterfaceA
imm32
ImmAssociateContext
powrprof
GetPwrCapabilities
Sections
.text Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 144KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 192KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ