c:\Sky\Your\Whether\third\caught\Glad\redExperience.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5b492fc2985093f662d9a81750ba6a4f_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
5b492fc2985093f662d9a81750ba6a4f_JaffaCakes118
-
Size
1.1MB
-
MD5
5b492fc2985093f662d9a81750ba6a4f
-
SHA1
2e2e0383e1bc07d9e9d4e276f6023069c2092aa9
-
SHA256
4897867a32a0878e85a2a30694710b9f11e45e3f9c551f93bd636a07c0286d8d
-
SHA512
6855428b02b517fc14f34239a80c2de4e8a5a413b728b9432a9e3d8bc4d208b83589c85a4317dbed0b5422e1a5d81fc12cb370c0538755f24be3e2954d433b3f
-
SSDEEP
12288:CYm1jMb5SaPBtY7wC2jS4kVTc5TFFwfe1KNVoL0stR4xlnH:BxY8C227TITgfeRhKrn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b492fc2985093f662d9a81750ba6a4f_JaffaCakes118
Files
-
5b492fc2985093f662d9a81750ba6a4f_JaffaCakes118.exe windows:5 windows x86 arch:x86
3962638d053ab5d0f5a79698895c7f2a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Sleep
GetProcAddress
LoadLibraryA
WriteProfileStringA
GetCurrentDirectoryA
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
HeapSize
CloseHandle
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
VirtualAlloc
GetStringTypeW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
GetCPInfo
RaiseException
GetLastError
HeapFree
RtlUnwind
LCMapStringA
LCMapStringW
HeapAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetModuleHandleA
ole32
CoUninitialize
CLSIDFromString
OleInitialize
OleUninitialize
CoInitialize
CoCreateInstance
Sections
.text Size: 418KB - Virtual size: 417KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 49KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 602KB - Virtual size: 601KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ