C:\Users\Yordanyan\source\repos\ActiveAgent\Release\ActiveAgent.pdb
Static task
static1
Behavioral task
behavioral1
Sample
404bbbd96642e88d3319b1dd413baa82_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
404bbbd96642e88d3319b1dd413baa82_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
404bbbd96642e88d3319b1dd413baa82_JaffaCakes118
-
Size
1.4MB
-
MD5
404bbbd96642e88d3319b1dd413baa82
-
SHA1
3ab9752f6ee487c8da88cfc8788d5387c077a9c8
-
SHA256
50c7055d0d3be70140ade1e7bf299d8c398dfcbd1f414be5c96447e1e51dba15
-
SHA512
14600e59b22cf8d7434a0fcea076234dee58d89c1d1ca23117cbfda4202c2d86c33371f727eedb4e073716ed778d28b2a4331144cc3cd58846fa57ddfee9ca06
-
SSDEEP
24576:LpaKUcZpoo4doTuCjkxFMCPVzXZOZAWSaT3KPNldlObGFra0Nldl6bZCucoo:iZCOr8ZtNT6zXnFr/Xk7o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 404bbbd96642e88d3319b1dd413baa82_JaffaCakes118
Files
-
404bbbd96642e88d3319b1dd413baa82_JaffaCakes118.exe windows:6 windows x86 arch:x86
ab4a58b1c956cd7bc15537202622928b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLastError
Sleep
WaitForSingleObject
OpenProcess
TerminateProcess
GetCurrentProcessId
WriteConsoleW
CreateMutexW
OutputDebugStringW
GetVersionExW
HeapSize
CreateFileW
ReadConsoleW
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindNextFileW
GetModuleFileNameW
FindClose
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
HeapAlloc
HeapFree
WriteFile
GetStdHandle
ExitProcess
RtlUnwind
GetStartupInfoW
CloseHandle
FindFirstFileExW
GetCurrentProcess
GetSystemTimeAsFileTime
GetModuleHandleA
FormatMessageW
VerSetConditionMask
GlobalFree
VerifyVersionInfoW
EncodePointer
DecodePointer
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
QueueUserWorkItem
GetModuleHandleExW
IsProcessorFeaturePresent
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
CreateTimerQueue
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetEndOfFile
advapi32
OpenProcessToken
GetTokenInformation
shell32
ShellExecuteW
ShellExecuteExW
ole32
CoInitialize
CoCreateInstance
urlmon
URLDownloadToFileW
winhttp
WinHttpSetStatusCallback
WinHttpGetDefaultProxyConfiguration
WinHttpOpen
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpSetCredentials
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpSetOption
WinHttpQueryOption
WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpConnect
bcrypt
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
crypt32
CryptUnprotectMemory
Sections
.text Size: 723KB - Virtual size: 723KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 175KB - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 46KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 470KB - Virtual size: 470KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ