CNWKJEHNEWOI!#@OpTKYH_)BPORWKBJ@*(#.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a0f91b379f17872beb8c8a9f3d887999_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
a0f91b379f17872beb8c8a9f3d887999_JaffaCakes118
-
Size
236KB
-
MD5
a0f91b379f17872beb8c8a9f3d887999
-
SHA1
17db36f2a66ef54a58a0701b3709c66371149aa6
-
SHA256
a075a3900d212b71c20a5de79225bcf6e8d2b4f626bfb430c34976c875190bce
-
SHA512
b40caef927d07cdc796318964e7fed9bc89e247c860914af574904d884a89cd6fe01a7bb0effb679d79736a6b271b1f2fcdf50c87e51bb6f76e628f5e5fc0769
-
SSDEEP
1536:aqXVR3fTcZ4T5EIy/YhTG/avFYnxPMy8OToF0PrU16BS8+sDun/sCpZieSKz:acvC/I1iSvFEvoFWUIo8+sDunkMZi5K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0f91b379f17872beb8c8a9f3d887999_JaffaCakes118
Files
-
a0f91b379f17872beb8c8a9f3d887999_JaffaCakes118.exe windows:5 windows x86 arch:x86
fc13679117adc06bfca073ebb23aa46b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetThreadLocale
GetModuleHandleA
GetProcessHandleCount
GetBinaryTypeA
lstrlenW
GetFileMUIPath
GetModuleFileNameA
GetConsoleWindow
IsValidCodePage
GetCurrentThreadId
WritePrivateProfileStructA
GetProcAddress
VirtualQueryEx
GetPrivateProfileStructW
EnumResourceNamesW
GetVolumeInformationW
LoadLibraryExW
UnlockFileEx
gdi32
GetCharWidth32A
GetTextMetricsA
GetMetaFileBitsEx
GetBitmapBits
FlattenPath
DeleteMetaFile
advapi32
RemoveUsersFromEncryptedFile
QueryUsersOnEncryptedFile
EnumServicesStatusExW
winspool.drv
FindNextPrinterChangeNotification
wininet
FindNextUrlCacheEntryExW
powrprof
PowerRestoreDefaultPowerSchemes
mscms
GetColorProfileHeader
lz32
LZSeek
user32
DdeFreeStringHandle
GetPriorityClipboardFormat
DestroyIcon
LockWindowUpdate
LoadAcceleratorsW
DeferWindowPos
GetForegroundWindow
Sections
.text Size: 216KB - Virtual size: 213KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ