c:\Build\desktop_apps\_out\launcher.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5e1b60262dcfba4d483107af1c53bb90_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
5e1b60262dcfba4d483107af1c53bb90_JaffaCakes118
-
Size
154KB
-
MD5
5e1b60262dcfba4d483107af1c53bb90
-
SHA1
ee78668509e9275dd18705d673add764a83ab0ce
-
SHA256
cda5caee9614a046d4275b2218d0843123ee9e58e0375594c5b8055667748fa1
-
SHA512
bd32087ec95a4ef0c1dfd2d577a14bc34efda3ce531721a4b84c84cc958e0ccddc009fca060e8c311f7efd14f3c7d0497140b23d474b44e8fc4a9ef779d192ae
-
SSDEEP
3072:DrAVguiZxHF02SOacgAf+9mzB7y7YRguXt:DWgVZ1vGAfL1X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e1b60262dcfba4d483107af1c53bb90_JaffaCakes118
Files
-
5e1b60262dcfba4d483107af1c53bb90_JaffaCakes118.exe windows:5 windows x86 arch:x86
a014231d8d3ba11961a4eec9f6ade3b3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetModuleFileNameW
DeleteFileW
GetTempFileNameW
GetTempPathW
CreateFileW
CreateDirectoryW
ReadFile
WriteFile
GetFileSize
FormatMessageA
GetModuleHandleA
LockFileEx
UnlockFile
GetVersionExW
CreateProcessW
CloseHandle
WaitForSingleObject
MultiByteToWideChar
WideCharToMultiByte
LocalFree
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetACP
GetModuleHandleW
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
RtlUnwind
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetProcAddress
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
IsDebuggerPresent
GetCurrentThreadId
OutputDebugStringW
LoadLibraryExW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
SetFilePointerEx
IsValidCodePage
GetOEMCP
SetStdHandle
shell32
SHGetFolderPathW
ole32
StringFromCLSID
CoCreateGuid
CoTaskMemFree
winhttp
WinHttpReadData
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpSendRequest
WinHttpCrackUrl
WinHttpConnect
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpOpen
ws2_32
ntohl
crypt32
CryptDecodeObjectEx
CryptImportPublicKeyInfo
CryptStringToBinaryA
CryptBinaryToStringW
advapi32
CryptHashData
CryptVerifySignatureW
CryptDestroyHash
CryptCreateHash
CryptDestroyKey
CryptAcquireContextW
CryptReleaseContext
Sections
.text Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ