C:\mmp\source\setup\keywordkr\setup\atlexe\atlexe.cpp1kkr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0c363a002299ade2beeff25ac689446d_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0c363a002299ade2beeff25ac689446d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0c363a002299ade2beeff25ac689446d_JaffaCakes118
-
Size
126KB
-
MD5
0c363a002299ade2beeff25ac689446d
-
SHA1
36fbe53bd05932362891ccea2e7f6a99adc9b4bd
-
SHA256
ca899e81d6e17cef0e6c97d5a596932e19ce2e9532358d1823a0943eb727fcb8
-
SHA512
ff62df4c1797d227edeff390af2d61e7c5c7e85ad6151dcfe7ef97f093e1068b0152fb38e9212d546e4e78579707cddb47ec3af0b99b4455637d63ec73a19f56
-
SSDEEP
3072:t8Sss5CxCmzwGwPDHy1EUYp5GpGrHGgqy4+7rQ5D:t2s0xC3rytGjGgqyPu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c363a002299ade2beeff25ac689446d_JaffaCakes118
Files
-
0c363a002299ade2beeff25ac689446d_JaffaCakes118.exe windows:5 windows x86 arch:x86
5ee8525aa51fcf9ff15c28e6938ebda6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetFileAttributesExA
ExpandEnvironmentStringsA
lstrcatA
lstrcpyA
GetModuleHandleA
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
SetEvent
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetTickCount
lstrcmpiA
GetLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
CloseHandle
GetFileTime
CreateFileA
GetTempPathA
GetLastError
CreateMutexA
MoveFileA
DeleteFileA
GetCommandLineA
Sleep
LoadLibraryA
CreateThread
GetProcessHeap
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
GetProcAddress
FreeLibrary
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
RaiseException
WideCharToMultiByte
WaitForSingleObject
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
HeapSize
SetFilePointer
GetFileType
SetHandleCount
ReadFile
GetStdHandle
WriteFile
ExitProcess
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
VirtualFree
HeapCreate
GetStartupInfoA
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
HeapReAlloc
HeapAlloc
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
user32
GetMessageA
BringWindowToTop
ShowWindow
FindWindowA
SendMessageTimeoutA
RegisterWindowMessageA
UpdateWindow
CreateWindowExA
PostThreadMessageA
GetSystemMetrics
GetClassNameA
EnumChildWindows
IsWindow
EnumWindows
SetTimer
PostQuitMessage
wsprintfA
MessageBoxA
TranslateMessage
DispatchMessageA
DefWindowProcA
LoadCursorA
RegisterClassExA
MoveWindow
advapi32
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
shell32
ShellExecuteA
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
LoadTypeLi
LoadRegTypeLi
DispCallFunc
SysFreeString
SysAllocString
VariantInit
VariantClear
SysStringLen
shlwapi
PathFileExistsA
PathRemoveBlanksA
PathFindFileNameA
PathGetArgsA
urlmon
URLDownloadToFileA
ws2_32
socket
WSAStartup
htons
gethostbyname
closesocket
ioctlsocket
connect
select
__WSAFDIsSet
send
recv
netapi32
Netbios
Sections
.text Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ