mi_exe_stub.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9faeaa036100e37c5488f84d13c1663d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9faeaa036100e37c5488f84d13c1663d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9faeaa036100e37c5488f84d13c1663d_JaffaCakes118
-
Size
521KB
-
MD5
9faeaa036100e37c5488f84d13c1663d
-
SHA1
25ec40c0a75fc54aded5c51e6494eeffbaa61ee4
-
SHA256
127230bad4470d807219ff8b9ddaa2bd2949a605214020d81afc383ac739e775
-
SHA512
541fc1e9d5f120c8f5a708eb280f4d3fa85e4cec8a2f66dfa842d17ecf6a33f69ce172fe754ca73e2bebe2326a289260feb658fad84f245f5a28ee27dea06095
-
SSDEEP
12288:OM+HFwtnysCJIlRfgfjCJLl4XfU85SNALN+1asV:olwtnnCJI824X88EALNqasV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9faeaa036100e37c5488f84d13c1663d_JaffaCakes118
Files
-
9faeaa036100e37c5488f84d13c1663d_JaffaCakes118.exe windows:5 windows x86 arch:x86
e7f19ec5c0f214a76484af5d120d7f4c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
ExitProcess
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
HeapReAlloc
HeapAlloc
GetProcessHeap
RtlUnwind
CreateFileA
FindResourceA
lstrcmpA
LoadResource
WriteFile
FindResourceExA
WideCharToMultiByte
SizeofResource
RaiseException
CreateDirectoryA
InterlockedExchange
GetLastError
SetLastError
RemoveDirectoryA
GetTempFileNameA
LockResource
GetModuleFileNameA
GetVersionExA
CloseHandle
GetTempPathA
DeleteFileA
MapViewOfFile
UnmapViewOfFile
VirtualQuery
CreateFileMappingA
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
SetFilePointer
ReadFile
GetACP
GetLocaleInfoA
GetThreadLocale
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
HeapFree
HeapSize
shlwapi
PathQuoteSpacesA
ole32
CoUninitialize
CoInitializeEx
user32
UnregisterClassA
CharNextA
wvsprintfA
CharLowerBuffA
MessageBoxA
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 484B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 504KB - Virtual size: 504KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE