D:\sdrsharp\Release\x86\spyserver.pdb
Static task
static1
Behavioral task
behavioral1
Sample
46c7c3c944376d470b4537d9bb791f99_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
46c7c3c944376d470b4537d9bb791f99_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
46c7c3c944376d470b4537d9bb791f99_JaffaCakes118
-
Size
643KB
-
MD5
46c7c3c944376d470b4537d9bb791f99
-
SHA1
0f1988cc01d71301589473d3b472b3ef96af04d8
-
SHA256
1c28a2453cd1b2383b658531407ef52821be180b4cb4fc069a8f2b8de59feff6
-
SHA512
44a253a4ba91fd36848470290fe5cfa99fb2c24df02923bbfc3ab67769ff2a0e1e4ba72452e5bb7e392b3a74041b3407e0a30adad8aef50143af02a991954bbb
-
SSDEEP
12288:ImBcCyjjPowxjca6VJo9+fX1OwxZmLo0nAIra4utn2yjLdOTzLqCg1vVtVHPY:I+cljPowxjca6VJC+fT6Loyc7dyzrg1O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46c7c3c944376d470b4537d9bb791f99_JaffaCakes118
Files
-
46c7c3c944376d470b4537d9bb791f99_JaffaCakes118.exe windows:6 windows x86 arch:x86
ad8893564c4bf7ef6449366430a8080a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
winmm
timeBeginPeriod
timeEndPeriod
ws2_32
bind
closesocket
gethostbyname
select
listen
send
socket
__WSAFDIsSet
connect
inet_ntoa
recv
htonl
htons
ioctlsocket
setsockopt
WSAGetLastError
WSACleanup
WSAStartup
accept
ntohs
kernel32
SetEvent
SetEndOfFile
WriteConsoleW
CreateFileW
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
SetFilePointerEx
GetFileSizeEx
SetConsoleCtrlHandler
Sleep
GetVersionExW
GetSystemInfo
LoadLibraryW
GetProcAddress
FreeLibrary
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
CloseHandle
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
QueryPerformanceCounter
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
GetLastError
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
RaiseException
ExitThread
GetModuleHandleExW
GetStdHandle
WriteFile
ExitProcess
GetCommandLineA
GetCommandLineW
HeapReAlloc
HeapSize
HeapAlloc
HeapFree
user32
GetSystemMetrics
Sections
.text Size: 362KB - Virtual size: 362KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 146KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ