whWEHREHW##.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7b4c22a84fd75e8aa392db7afb7adf85_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7b4c22a84fd75e8aa392db7afb7adf85_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
7b4c22a84fd75e8aa392db7afb7adf85_JaffaCakes118
-
Size
153KB
-
MD5
7b4c22a84fd75e8aa392db7afb7adf85
-
SHA1
84267e32da2a0760f6b12d71c1649f5850bdfbca
-
SHA256
16c50a4a6d6354002963bd6ae598b963a52a056c597c089e84b7e7a2ade8a8a7
-
SHA512
d202a78d3448989815d17b5f91337c95c7ea01bc8b763439705a78baa7b5ed361418c45c542efbf4f47ea0d8daeee2799337f617f3f86944de3e6b28c574b975
-
SSDEEP
3072:A5yzZaMq1t+gh7AMaDI2r8O+9GTGxP8X8qYKf9zAWE6DWrM:2yzZl63Naf8r92GzqvbD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7b4c22a84fd75e8aa392db7afb7adf85_JaffaCakes118
Files
-
7b4c22a84fd75e8aa392db7afb7adf85_JaffaCakes118.exe windows:5 windows x86 arch:x86
77b0c67f9d36eb0201e19403697056ea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
secur32
DeleteSecurityContext
msvcrt
ungetwc
version
GetFileVersionInfoSizeA
kernel32
FindActCtxSectionGuid
LockResource
EnumSystemLocalesW
GetProfileIntW
LocalReAlloc
GetThreadSelectorEntry
GetThreadId
GetQueuedCompletionStatus
GetCurrencyFormatA
lstrcmpW
GetDiskFreeSpaceW
Module32Next
GlobalMemoryStatus
GetFileAttributesW
GetProfileSectionA
GetBinaryTypeA
lstrlenA
EnumTimeFormatsA
advapi32
LogonUserW
GetWindowsAccountDomainSid
DeleteService
winspool.drv
GetPrinterW
gdi32
ExtEscape
GetMapMode
ws2_32
socket
rasapi32
RasRenameEntryA
user32
GetWindowWord
DrawIcon
DdeDisconnectList
GetWindowPlacement
ShowCursor
DestroyAcceleratorTable
GetFocus
GetKeyboardLayoutNameA
GetClipboardOwner
GetDesktopWindow
GetWindowTextLengthW
GetMenuBarInfo
LockSetForegroundWindow
LoadIconA
msi
ord30
ord29
oleaut32
VarCyCmp
Sections
.text Size: 113KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ