C:\gifopilahalo48\sihuyelu75.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6a03ce9c474543fa16857b755e5e9f49_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
6a03ce9c474543fa16857b755e5e9f49_JaffaCakes118
-
Size
633KB
-
MD5
6a03ce9c474543fa16857b755e5e9f49
-
SHA1
fb78a545d1674271bac5a44cefbd6782a46a3941
-
SHA256
85e49bfd4b1b99d1dd84d9aa6d312358c842b792a9c479dd0669e5dbd2e6a7d8
-
SHA512
e8dd75ef1c7f47b38318e00549501d6cf7b7fb72900f4a45c84cc943a584b2fded8cf879cfa93a028daa5cb5c6a43b3b1b7c32140860aada1a559baf02104487
-
SSDEEP
12288:9Bzz1dUnRXbRzrSEKQXzf7TvUK/FhWKhRFwnXTl:Tz1dUnVRz7XzfvUK/FkhD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 6a03ce9c474543fa16857b755e5e9f49_JaffaCakes118
Files
-
6a03ce9c474543fa16857b755e5e9f49_JaffaCakes118.exe windows:5 windows x86 arch:x86
c4f5c7aa8bb74aaf65b3937bedd5b557
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
PeekNamedPipe
CreateMailslotW
lstrcmpW
lstrlenA
OpenSemaphoreA
LoadLibraryA
LoadLibraryW
GetModuleFileNameW
GetFirmwareEnvironmentVariableW
FindResourceExW
EndUpdateResourceA
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesA
GetCurrentDirectoryW
CreateDirectoryExA
DefineDosDeviceW
GetFileAttributesExW
GetSystemTimes
CopyFileA
IsBadStringPtrA
GetDefaultCommConfigA
QueryPerformanceFrequency
OpenJobObjectW
QueryInformationJobObject
ReleaseActCtx
IsDBCSLeadByteEx
GetCalendarInfoW
SetCalendarInfoA
EnumDateFormatsA
GetUserDefaultLangID
ReadConsoleInputA
AllocConsole
WriteConsoleW
GetFileTime
RequestDeviceWakeup
GetFileSizeEx
LockFile
GlobalDeleteAtom
FreeEnvironmentStringsW
GetEnvironmentStringsW
TerminateProcess
HeapWalk
HeapAlloc
VirtualAllocEx
VirtualProtect
LocalAlloc
GlobalUnlock
DeleteFileW
GetVersion
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
GetFileType
GetStringTypeW
DecodePointer
CloseHandle
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
LCMapStringW
SetStdHandle
GetProcessHeap
RaiseException
HeapSize
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
CreateFileW
user32
GetKeyNameTextA
GetMonitorInfoW
advapi32
RegSaveKeyA
RegQueryValueExW
RegQueryValueExA
RegQueryValueA
RegOpenKeyExA
RegCreateKeyA
RegCloseKey
GetFileSecurityW
SetSecurityDescriptorControl
AddAccessDeniedAce
DeleteAce
AreAnyAccessesGranted
ObjectPrivilegeAuditAlarmA
ClearEventLogW
RegisterServiceCtrlHandlerW
Sections
.text Size: 85KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 32.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 488KB - Virtual size: 487KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ