C:\tiser36-gag.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7d2fd8b4be11765884b9c5b298621018_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7d2fd8b4be11765884b9c5b298621018_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
7d2fd8b4be11765884b9c5b298621018_JaffaCakes118
-
Size
4.9MB
-
MD5
7d2fd8b4be11765884b9c5b298621018
-
SHA1
0d5c5fada25149cf6f8776b801d0354122195379
-
SHA256
9f305a26fce9c4361011e4c676047c9be211eb46123425693059a4ab41274795
-
SHA512
8aa8e4cde73bcbe9f5e7972633f0d3e855b221b5ed1607109fe98c4ea909fa9209056e8563c8f5b47fd45f0d71fe59e102d1fba792f04599a6403a5f95eae472
-
SSDEEP
98304:0pGhQPg7c4nI5MaMHHFS3yFkFLVcOSoPtgkg6hbr6w322XQYz2NmcfOoV0tmvP7/:zh3cwIafATf9gkph332mrz2NDfODsnem
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7d2fd8b4be11765884b9c5b298621018_JaffaCakes118
Files
-
7d2fd8b4be11765884b9c5b298621018_JaffaCakes118.exe windows:5 windows x86 arch:x86
26854ec0abecd5be60de865282f697b9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GlobalAlloc
GlobalLock
GlobalMemoryStatus
VirtualProtect
SetUnhandledExceptionFilter
GetLastError
TryEnterCriticalSection
UnlockFile
CloseHandle
GetCommTimeouts
GetSystemTimes
GetTickCount
FormatMessageW
CreateMailslotW
lstrcpynA
lstrlenW
GetProfileStringA
GetCurrentDirectoryW
GetVolumeNameForVolumeMountPointA
GetNumberFormatA
EnumSystemLocalesA
PeekConsoleInputW
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetStringTypeW
OutputDebugStringW
SetFilePointerEx
GetConsoleMode
EncodePointer
DecodePointer
IsProcessorFeaturePresent
RaiseException
RtlUnwind
GetCommandLineA
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
HeapSize
IsDebuggerPresent
SetLastError
GetCurrentThreadId
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
GetConsoleCP
CreateFileW
user32
GetPropW
GetMenuItemInfoA
GetMessageExtraInfo
SetCursor
msimg32
TransparentBlt
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4.8MB - Virtual size: 12.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ