c:\cover\child\clock\sinceFall.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7ea90e877f1187b11920128d6a3a1574_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
7ea90e877f1187b11920128d6a3a1574_JaffaCakes118
-
Size
410KB
-
MD5
7ea90e877f1187b11920128d6a3a1574
-
SHA1
44e3dbe0b747c760c8623e3f143a7eb3bf76c972
-
SHA256
e47a25808624969f88cbafc9de3d49b3fd41b616fb28fe3a1e344341d4777671
-
SHA512
c527afc070058e4333ec819831ccfd44e4e46f3c72070074117afe51ffdf7144f544ad37d07a166be49131bb81e5eed1af6b7de2ea41ea745d2f3f0cb0cdaa47
-
SSDEEP
6144:O3lYafWLlGXxnrgsVA6WetdjDUDSNuLBRxFqD89ciXRGk8xKsR5F03SkoRHT:OeGXh/AReLnuvxUDqmVR4ikoRHT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7ea90e877f1187b11920128d6a3a1574_JaffaCakes118
Files
-
7ea90e877f1187b11920128d6a3a1574_JaffaCakes118.exe windows:5 windows x86 arch:x86
94c9aad657fe904708c5deafb1622774
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WriteConsoleA
CloseHandle
SetEnvironmentVariableA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
GetProcessHeap
HeapAlloc
GetTempPathA
Sleep
VirtualProtectEx
GetFileAttributesA
CreateProcessA
CompareStringW
CompareStringA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapSize
InitializeCriticalSectionAndSpinCount
LoadLibraryA
CreateFileA
GetLocalTime
SetSystemPowerState
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
GetTimeZoneInformation
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetLastError
HeapFree
EnterCriticalSection
LeaveCriticalSection
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
user32
UnhookWinEvent
comctl32
ImageList_ReplaceIcon
ImageList_Draw
comdlg32
GetFileTitleA
GetOpenFileNameA
GetSaveFileNameA
ole32
CoUninitialize
CoRevokeClassObject
CoInitialize
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid
FreeSid
OpenProcessToken
StartServiceCtrlDispatcherA
InitializeSecurityDescriptor
RegEnumKeyA
RegSetValueExA
RegisterServiceCtrlHandlerA
SetServiceStatus
AdjustTokenPrivileges
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
GetTokenInformation
LookupPrivilegeValueA
netapi32
NetApiBufferFree
NetWkstaSetInfo
secur32
ImpersonateSecurityContext
FreeContextBuffer
InitializeSecurityContextA
FreeCredentialsHandle
AcquireCredentialsHandleA
aclui
ord2
ord1
oleacc
GetOleaccVersionInfo
AccessibleObjectFromPoint
Sections
.text Size: 233KB - Virtual size: 233KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 157KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ