c:\Build\_source\RMS_init\bin\SetDACL.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0ff3dc59c82c8806edb8ce8f5fa4ae73_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0ff3dc59c82c8806edb8ce8f5fa4ae73_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0ff3dc59c82c8806edb8ce8f5fa4ae73_JaffaCakes118
-
Size
353KB
-
MD5
0ff3dc59c82c8806edb8ce8f5fa4ae73
-
SHA1
9fe7e61a5cc1892c1ce4978d1b077002b39cd211
-
SHA256
09b4dfa5bfe34b39b5fccac4b3519d3348cbac0cbfe0d86012a5390ae1a5dc24
-
SHA512
4b602e46a514f3f87d0ab95b8d0a38ebc0f048d8d3fd875f49422ec7968f326deefeed52e73f27ee44239a815de7a60d0af0c4caef29f239d527588e915975c4
-
SSDEEP
6144:ktswQLUtlKcYtswQLUtlKuetswQLUtlKk/tswQLUtlKdD:ktBQLUtlpYtBQLUtl/etBQLUtlB/tBQx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ff3dc59c82c8806edb8ce8f5fa4ae73_JaffaCakes118
Files
-
0ff3dc59c82c8806edb8ce8f5fa4ae73_JaffaCakes118.exe windows:4 windows x86 arch:x86
a44a00c9bae24d0478e7861db91a66b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLocaleInfoW
LoadLibraryA
IsBadCodePtr
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetLocaleInfoA
GetACP
SetLastError
InterlockedExchange
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
GetStartupInfoA
GetCommandLineA
LCMapStringA
LCMapStringW
GetCPInfo
HeapCreate
VirtualFree
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
GetOEMCP
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
IsBadReadPtr
user32
MessageBoxA
advapi32
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
SetNamedSecurityInfoA
SetSecurityInfo
InitializeAcl
AddAce
GetLengthSid
CopySid
IsValidSid
RegCreateKeyExA
RegCloseKey
LookupAccountNameA
Sections
.text Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ