c:\Build\_source\RMS_init\bin\SetDACL.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0e9d888d1eaa44704e5abfd924d8f14c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0e9d888d1eaa44704e5abfd924d8f14c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0e9d888d1eaa44704e5abfd924d8f14c_JaffaCakes118
-
Size
441KB
-
MD5
0e9d888d1eaa44704e5abfd924d8f14c
-
SHA1
243992861e5482a364e3a3ec130f4a77644c4fc3
-
SHA256
89cb66b6dca72cec92387ea1f73cad9b7356ded288c943ee9d96aba80e3df34c
-
SHA512
71eeb5cf7990a0b907a0788d4a2bdf99edca6c81577e192d3136c754f0a167d15770e32469c4f4542c63981c46bdfa8dc020cad352b85a9083e0e1a65217a14c
-
SSDEEP
12288:ktBQLUtlAtBQLUtlpYtBQLUtl/etBQLUtlB/tBQLUtl4U:ktqOlAtqOlpYtqOl/etqOlB/tqOl4U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e9d888d1eaa44704e5abfd924d8f14c_JaffaCakes118
Files
-
0e9d888d1eaa44704e5abfd924d8f14c_JaffaCakes118.exe windows:4 windows x86 arch:x86
a44a00c9bae24d0478e7861db91a66b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLocaleInfoW
LoadLibraryA
IsBadCodePtr
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetLocaleInfoA
GetACP
SetLastError
InterlockedExchange
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
GetStartupInfoA
GetCommandLineA
LCMapStringA
LCMapStringW
GetCPInfo
HeapCreate
VirtualFree
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
GetOEMCP
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
IsBadReadPtr
user32
MessageBoxA
advapi32
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
SetNamedSecurityInfoA
SetSecurityInfo
InitializeAcl
AddAce
GetLengthSid
CopySid
IsValidSid
RegCreateKeyExA
RegCloseKey
LookupAccountNameA
Sections
.text Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ