rundll32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0a2294d9e77a0069450eb1534fe01d2b_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0a2294d9e77a0069450eb1534fe01d2b_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0a2294d9e77a0069450eb1534fe01d2b_JaffaCakes118
-
Size
83KB
-
MD5
0a2294d9e77a0069450eb1534fe01d2b
-
SHA1
9c6c764a2e4ebe238b23b992eb2368053ffbe2d0
-
SHA256
ca8af8a1cd97015b05bfb72474922ed6d788f1f77e7ead28d95231f2f740375c
-
SHA512
ea821912ef071ce8c13f2459273d0c141f4449287abb1d6dea026cdfeabe8e9a38cddb7460a1f9279f47084e9fa1c6ae248f11ad5196f7087b12e90c6cb49bac
-
SSDEEP
1536:0+QWvZhSRqln5IUmDjoXVG5SteJSzofHSDQedyO65ScTViu/GO4Qoe6:wWvZ0Rqln5I35SYYofHjewO65ScxiurN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a2294d9e77a0069450eb1534fe01d2b_JaffaCakes118
Files
-
0a2294d9e77a0069450eb1534fe01d2b_JaffaCakes118.exe windows:6 windows x86 arch:x86
ef8a44fe2f9ad4ab85e55004aaa024a9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
HeapSetInformation
QueryActCtxW
CloseHandle
SetFilePointer
ReadFile
CreateFileW
LocalFree
lstrlenA
WideCharToMultiByte
LocalAlloc
lstrlenW
GetProcAddress
WaitForSingleObject
CreateProcessW
GetCommandLineW
Wow64EnableWow64FsRedirection
GetSystemDirectoryW
GetNativeSystemInfo
IsWow64Process
GetCurrentProcess
SetProcessDEPPolicy
FormatMessageW
GetLastError
LoadLibraryExW
FreeLibrary
ExitProcess
SetErrorMode
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
Sleep
GetStartupInfoW
InterlockedExchange
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
CompareStringW
ReleaseActCtx
DeactivateActCtx
GetFileAttributesW
SearchPathW
CreateActCtxW
GetModuleHandleW
ActivateActCtx
user32
LoadIconW
CharNextW
DefWindowProcW
GetClassLongW
GetClassNameW
GetWindow
GetWindowLongW
SetWindowLongW
SetClassLongW
CreateWindowExW
RegisterClassW
LoadCursorW
LoadStringW
MessageBoxW
DestroyWindow
msvcrt
iswalpha
_wtoi
wcschr
__wgetmainargs
memset
_vsnwprintf
__set_app_type
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
imagehlp
ImageDirectoryEntryToData
ntdll
NtClose
NtOpenProcessToken
NtSetInformationToken
RtlImageNtHeader
NtSetInformationProcess
NtQueryInformationToken
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE