C:\cesoga.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9e76ee5f1468a3ef0b6350f1a9ef99d9_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
9e76ee5f1468a3ef0b6350f1a9ef99d9_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9e76ee5f1468a3ef0b6350f1a9ef99d9_JaffaCakes118
-
Size
391KB
-
MD5
9e76ee5f1468a3ef0b6350f1a9ef99d9
-
SHA1
371f1e0bf5dbd6a239b09dec59f5aa4e526bd072
-
SHA256
5e671e74e1fa81ca986c3b45ff13deaef27bd2ed866f5ad60e99ac4e0e212fed
-
SHA512
78f3e679346debabb7ebfeacaef88892ff1c865ac7e04a281ecd2305f790268ef539c622f272452259221ccc964f4d0d64dc97d0b922038855e28ddecf0e288c
-
SSDEEP
6144:meTJWTZ2r6xuH9Kkpl0APIs49tNUCS0ynyG2hBWG54U1TXtxQJN:meF4YH9K20rsEK//yHWjUBQJN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 9e76ee5f1468a3ef0b6350f1a9ef99d9_JaffaCakes118
Files
-
9e76ee5f1468a3ef0b6350f1a9ef99d9_JaffaCakes118.exe windows:5 windows x86 arch:x86
eb99c90699328994e861519ede554244
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetDriveTypeW
MoveFileExA
GetProfileIntW
HeapAlloc
GetProfileStringW
WaitForSingleObject
GetModuleHandleW
ExpandEnvironmentStringsA
WaitNamedPipeW
EnumTimeFormatsA
LoadLibraryW
FormatMessageW
SetConsoleCP
GetStringTypeExW
IsProcessorFeaturePresent
GetSystemDirectoryA
GetOverlappedResult
ReplaceFileA
EnumSystemLocalesA
GetLastError
ChangeTimerQueueTimer
GetLongPathNameW
DefineDosDeviceW
MoveFileW
GetFirmwareEnvironmentVariableW
LocalAlloc
WritePrivateProfileStringA
FindFirstVolumeMountPointW
HeapLock
GetVolumePathNamesForVolumeNameA
GetDefaultCommConfigA
CreateMailslotA
VirtualProtect
DeleteCriticalSection
MoveFileWithProgressW
GetStringTypeW
ReadConsoleW
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
EncodePointer
DecodePointer
GetCommandLineA
RaiseException
RtlUnwind
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
GetStartupInfoW
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
WriteFile
GetModuleFileNameW
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
FatalAppExitA
HeapSize
HeapFree
CloseHandle
SetLastError
GetCurrentThread
GetCurrentThreadId
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
CreateSemaphoreW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetFilePointerEx
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryExW
OutputDebugStringW
SetStdHandle
WriteConsoleW
HeapReAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
CreateFileW
user32
RealGetWindowClassW
IsClipboardFormatAvailable
GetScrollBarInfo
CreateDialogIndirectParamW
GetAncestor
GetMessageTime
CallMsgFilterA
Sections
.text Size: 190KB - Virtual size: 190KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ