c:\tool\Build\Motion\winshall.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ae15f530f443647f79eacfe22530d619_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
ae15f530f443647f79eacfe22530d619_JaffaCakes118
-
Size
648KB
-
MD5
ae15f530f443647f79eacfe22530d619
-
SHA1
60940ceb36d48b099e1aea12d97787908797ac5d
-
SHA256
36ce8de570f8f9a8aa1a4e985de0c069fe23b43c41b5410d1c41e683c2640ea2
-
SHA512
303a4359dcb2cd1a32af4a11e466c93c8f334e0f069c1f636c16f23c24367748484ef4e8d266b75d30f1f59765db02c5f60e45b8c846d33e0b40b510ba8db643
-
SSDEEP
6144:Q5mTELUok+1NjIjODnupJnMZLrSPm4JZM1o7SVMVVadETPjSjCv4RgSNY5v6:Q5wEL3kEDnQdM9rEju0TH4l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ae15f530f443647f79eacfe22530d619_JaffaCakes118
Files
-
ae15f530f443647f79eacfe22530d619_JaffaCakes118.exe windows:4 windows x86 arch:x86
77cea1911784493eb43fbcf693c560e1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetCurrentThreadId
lstrcmpA
GlobalFlags
GlobalGetAtomNameA
GetThreadLocale
lstrcmpW
LoadLibraryA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GetLocaleInfoA
GetCPInfo
GetProcAddress
WriteFile
SetFilePointer
FlushFileBuffers
GetCurrentProcess
HeapFree
RtlUnwind
GetTimeFormatA
HeapReAlloc
VirtualAlloc
GetCommandLineA
RaiseException
HeapSize
ExitProcess
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentProcessId
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
LockResource
SizeofResource
SetLastError
lstrlenA
CompareStringW
CompareStringA
GetProcessHeap
HeapAlloc
GetSystemDirectoryA
GetTempPathA
GetModuleFileNameA
VirtualProtect
LoadResource
FindResourceA
GetDateFormatA
GetModuleHandleA
GetVersionExA
OpenProcess
GetSystemTime
GetVolumeInformationA
CreateFileA
QueryPerformanceCounter
GetTickCount
DeleteFileA
GetStartupInfoA
CloseHandle
CreateProcessA
Sleep
GetVersion
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetOEMCP
InterlockedExchange
user32
GrayStringA
PostQuitMessage
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
SetWindowTextA
UnregisterClassA
SetWindowsHookExA
CallNextHookEx
DrawTextExA
DispatchMessageA
GetKeyState
PeekMessageA
ValidateRect
LoadCursorA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
UnhookWindowsHookEx
GetWindowThreadProcessId
SendMessageA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
UnhookWinEvent
GetDlgItemInt
ShowScrollBar
SetCursor
InsertMenuItemA
SetDlgItemInt
FindWindowA
GetWindowTextA
ShowWindow
EnumChildWindows
GetAsyncKeyState
GetDC
GetClassNameA
DrawTextA
TabbedTextOutA
UpdateWindow
GetMessagePos
DestroyMenu
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
PostMessageA
GetFocus
comctl32
InitCommonControlsEx
ImageList_AddMasked
ImageList_SetIconSize
ImageList_SetBkColor
ImageList_Destroy
ImageList_Remove
comdlg32
ReplaceTextA
GetSaveFileNameA
GetOpenFileNameA
ole32
OleUninitialize
OleCreate
OleInitialize
oleaut32
VariantChangeType
VariantClear
VariantInit
uxtheme
OpenThemeData
DrawThemeText
GetThemeBackgroundRegion
CloseThemeData
oleacc
GetOleaccVersionInfo
AccessibleObjectFromPoint
CreateStdAccessibleObject
LresultFromObject
gdi32
GetClipBox
SetMapMode
RestoreDC
SaveDC
ExtTextOutA
SetBkColor
GetDeviceCaps
DeleteObject
CreateBitmap
PtVisible
RectVisible
TextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
SetTextColor
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
Sections
.text Size: 172KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 52KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 348KB - Virtual size: 346KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ