c:\production-recompile\preloader_2013\PRELOADER_7_RC1\recompile\2014071516013872\bin\Win32\Release\preloader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
aa1dbaf1a25015bebb5e275ff25102f2_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
aa1dbaf1a25015bebb5e275ff25102f2_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
aa1dbaf1a25015bebb5e275ff25102f2_JaffaCakes118
-
Size
807KB
-
MD5
aa1dbaf1a25015bebb5e275ff25102f2
-
SHA1
ad8972c3aa9f4d25dff3916d8e1f086ef8a6e303
-
SHA256
7b20738fe03c9f90dc39220a353939bd3dd576b52b39d013297a8092960e4e51
-
SHA512
628f4e30b7d690187082f875c406ee578c65692af81ee46b6677d03f7468ebfbf67ebd2ff62c9f9658a468b76c88ee852aac3ccffae18d734a5863ca2fca42f2
-
SSDEEP
24576:dFU3XZISMSND63Z/MM7tDFCcMt6fHHesScEVVU:WMSNOZ/l7tDF7MQesScEVVU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa1dbaf1a25015bebb5e275ff25102f2_JaffaCakes118
Files
-
aa1dbaf1a25015bebb5e275ff25102f2_JaffaCakes118.exe windows:5 windows x86 arch:x86
e35a6634f21fade0522c0742742c5834
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Sleep
EnterCriticalSection
LoadLibraryA
GetModuleHandleA
CloseHandle
InterlockedIncrement
InterlockedDecrement
GetModuleHandleExW
VirtualFree
IsBadReadPtr
GetLastError
GetProcAddress
GetFullPathNameW
GetEnvironmentVariableW
GetCurrentDirectoryW
GetFileAttributesExW
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
GetProcessHeap
WriteFile
SetLastError
DeleteFileA
ExitProcess
HeapReAlloc
MoveFileExA
CreateProcessW
SetUnhandledExceptionFilter
SystemTimeToFileTime
GetCurrentProcess
GetTickCount
OpenProcess
TerminateProcess
GetTempFileNameA
GetLocalTime
GetProcessId
AddVectoredExceptionHandler
DuplicateHandle
GetTempPathA
GetThreadContext
GetCurrentThread
WideCharToMultiByte
GetFileAttributesA
MultiByteToWideChar
CreateDirectoryA
RemoveDirectoryA
FindClose
GetCurrentDirectoryA
GetCurrentProcessId
CreateFileW
InterlockedCompareExchange
HeapFree
HeapAlloc
FreeLibrary
UnmapViewOfFile
GetFileSize
WriteConsoleW
FlushFileBuffers
GetCurrentThreadId
LoadLibraryExW
GetCommandLineA
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsDebuggerPresent
IsProcessorFeaturePresent
HeapSize
GetStdHandle
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleMode
SetFilePointerEx
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleCP
OutputDebugStringW
LoadLibraryW
LCMapStringW
GetStringTypeW
SetStdHandle
VirtualQuery
user32
MessageBoxA
advapi32
RegOpenKeyExA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
shell32
ShellExecuteExW
Sections
.text Size: 140KB - Virtual size: 139KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ