UI0Detect.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0530de79940707b2a48d9ded62f21128_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0530de79940707b2a48d9ded62f21128_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0530de79940707b2a48d9ded62f21128_JaffaCakes118
-
Size
62KB
-
MD5
0530de79940707b2a48d9ded62f21128
-
SHA1
3d5337c3b0356954749461dd4f6ecab32c98db88
-
SHA256
3d869606d9f1b7b69540bcf08fc3d6e6f3f5e7fc3fbac09c56a578a11aa7387b
-
SHA512
29dcde78711aa9fb5d73e6b82bd97994e027ad3efaaaa0f1afe50903d79c7322ca75366aa1543dd5908dd8ef50dba0b145a4420dcd5104292abe2fb033788515
-
SSDEEP
1536:tI4WkaAb5anFjMMW7MMs0+2vIi4Ftag0CSe9544p:tIZwlanlMMYMMsVQIlLag0y5D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0530de79940707b2a48d9ded62f21128_JaffaCakes118
Files
-
0530de79940707b2a48d9ded62f21128_JaffaCakes118.exe windows:6 windows x86 arch:x86
5de0cabe853d959c3319b51c8ec562e6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
CheckTokenMembership
SetServiceStatus
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
RevertToSelf
CreateProcessAsUserW
ImpersonateLoggedOnUser
kernel32
CloseHandle
UnmapViewOfFile
DuplicateHandle
GetCurrentProcess
MapViewOfFile
CreateFileMappingW
GetProcessHeap
HeapFree
lstrcmpW
K32GetModuleBaseNameW
K32GetModuleInformation
GetLastError
K32EnumProcessModules
CompareStringW
lstrlenW
CompareFileTime
GetSystemTimeAsFileTime
K32GetModuleFileNameExW
OpenProcess
GetCurrentProcessId
SetLastError
GetTickCount
HeapSetInformation
GetCurrentThreadId
LocalFree
FormatMessageW
GetModuleHandleW
CreateEventW
DelayLoadFailureHook
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LoadLibraryExA
Sleep
HeapAlloc
TerminateProcess
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedExchange
UnhandledExceptionFilter
gdi32
CreateSolidBrush
user32
EnumWindows
RegisterShellHookWindow
SetWindowLongW
RegisterWindowMessageW
PostQuitMessage
IsWindow
DestroyWindow
DefWindowProcW
SetTimer
GetLastInputInfo
MoveWindow
GetSystemMetrics
KillTimer
SetShellWindow
SystemParametersInfoW
ShowWindow
GetWindowTextW
RegisterClassW
GetWindow
UnregisterClassW
DispatchMessageW
GetMessageW
GetUserObjectInformationW
GetThreadDesktop
GetProcessWindowStation
LoadStringW
FlashWindowEx
DestroyIcon
LoadIconW
GetWindowRect
FindWindowW
SendMessageW
GetWindowLongW
GetClassLongW
PostMessageW
GetWindowThreadProcessId
GetWindowInfo
GetClassNameW
LoadCursorW
GetWindowTextLengthW
SetTaskmanWindow
CreateWindowExW
msvcrt
memset
_vsnwprintf
wcsrchr
_atoi64
__getmainargs
_exit
_XcptFilter
_ismbblead
exit
?terminate@@YAXXZ
_acmdln
_controlfp
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_initterm
_cexit
_amsg_exit
__setusermatherr
ntdll
WinSqmIsOptedIn
WinSqmSetDWORD
WinSqmEndSession
WinSqmStartSession
WinSqmSetString
WinSqmAddToAverageDWORD
WinSqmAddToStream
WinSqmIncrementDWORD
RtlAllocateAndInitializeSid
RtlFreeSid
wtsapi32
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
WTSDisconnectSession
WTSQueryUserToken
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winsta
WinStationGetSessionIds
WinStationRevertFromServicesSession
WinStationSwitchToServicesSession
shell32
SHGetFolderPathW
shlwapi
ord354
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ocjrupz Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE