CNWKJEHNEWOI!#@OpTKYH_)BPORWKBJ@*(#.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8163a6b0bf4a59fb0e3e4123f68e58a6_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
8163a6b0bf4a59fb0e3e4123f68e58a6_JaffaCakes118
-
Size
236KB
-
MD5
8163a6b0bf4a59fb0e3e4123f68e58a6
-
SHA1
85fac50ae920a26c8d32b0eee406cc43062f62f3
-
SHA256
5a029e7e8087c36a23aa576f2b27cfb7a61aa256c3446ec63d5cc828c4547aff
-
SHA512
2a893a026a7e45315785a7e332fbd26e5c80b3b73ae40aed43bbbab44768497f1ef2d5c18dbfa37fe477adf0c43dd9f706b8f03b51fc62c06dbf0aa446d27af9
-
SSDEEP
1536:T2+qX33DrwcltpaN7EO1R/+RrbzexDLC9K6ToSZEMdOpyTGPI6kK:T2CgO7EwGrMW9K6TKMpGPJkK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8163a6b0bf4a59fb0e3e4123f68e58a6_JaffaCakes118
Files
-
8163a6b0bf4a59fb0e3e4123f68e58a6_JaffaCakes118.exe windows:5 windows x86 arch:x86
1c76a3725fa7bef444b0bd8dbcd7c139
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
gdi32
GetCharWidth32A
GetMetaFileBitsEx
GetBitmapBits
DeleteMetaFile
GetTextMetricsA
FlattenPath
user32
DdeFreeStringHandle
DeferWindowPos
LockWindowUpdate
DestroyIcon
LoadAcceleratorsW
GetPriorityClipboardFormat
GetForegroundWindow
mscms
GetColorProfileHeader
advapi32
RemoveUsersFromEncryptedFile
QueryUsersOnEncryptedFile
EnumServicesStatusExW
lz32
LZSeek
kernel32
GetBinaryTypeA
GetProcessHandleCount
GetModuleHandleA
GetCurrentThreadId
IsValidCodePage
GetVolumeInformationW
GetFileMUIPath
UnlockFileEx
GetModuleFileNameA
GetPrivateProfileStructW
EnumResourceNamesW
GetThreadLocale
WritePrivateProfileStructA
VirtualQueryEx
lstrlenW
GetConsoleWindow
GetProcAddress
LoadLibraryExW
wininet
FindNextUrlCacheEntryExW
powrprof
PowerRestoreDefaultPowerSchemes
winspool.drv
FindNextPrinterChangeNotification
Sections
.text Size: 216KB - Virtual size: 212KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ