d:\winrun\Release\winrun.pdb
Static task
static1
Behavioral task
behavioral1
Sample
149c33eb8c66f880011223a49e23b66f_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
149c33eb8c66f880011223a49e23b66f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
149c33eb8c66f880011223a49e23b66f_JaffaCakes118
-
Size
228KB
-
MD5
149c33eb8c66f880011223a49e23b66f
-
SHA1
a9512878bfbac13de21c22fe3f2d2d6151b33958
-
SHA256
c066014a9fb2d1d1178188a08c4745115f1b7963234afcc0854ec805c5cd957e
-
SHA512
381c465818d606b91899e8d5940d00009017ae6bb4e7d52aeb6a34476b7695ef69751a7a4ffb8c2a3d63d31e566b41791aa740e3afeb450a706d68f622e6f59a
-
SSDEEP
3072:u/XW4eLaUffCExmuyxQXmTzkA1VP/EkJ+z6l+zBz:ukuotyxQ2kA1VkJNz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 149c33eb8c66f880011223a49e23b66f_JaffaCakes118
Files
-
149c33eb8c66f880011223a49e23b66f_JaffaCakes118.exe windows:4 windows x86 arch:x86
cd860c3426f94d133c4644ab7fcc32ce
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
wininet
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetCloseHandle
InternetReadFile
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
kernel32
RtlUnwind
EnumSystemLocalesA
SetEnvironmentVariableA
SetEndOfFile
GetLocaleInfoW
ReadFile
SetStdHandle
IsBadCodePtr
IsBadReadPtr
IsValidCodePage
CreateEventA
CreateSemaphoreA
DuplicateHandle
GetCurrentProcess
CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
GetTickCount
SetEvent
ReleaseSemaphore
GetLastError
GetFileAttributesA
GetFullPathNameA
GetModuleFileNameA
GetTempPathA
CreateDirectoryA
DeleteFileA
GetSystemTimeAsFileTime
WaitForSingleObject
GetCurrentThreadId
FreeLibrary
CreateFileA
GetProcAddress
LoadLibraryA
RemoveDirectoryA
FindClose
FindNextFileA
FindFirstFileA
WideCharToMultiByte
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
MultiByteToWideChar
RaiseException
InitializeCriticalSection
DeleteCriticalSection
CompareStringA
CompareStringW
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
InterlockedDecrement
InterlockedIncrement
Sleep
EnterCriticalSection
LeaveCriticalSection
ReleaseMutex
TlsAlloc
GetSystemInfo
CreateMutexA
GetCurrentProcessId
TlsGetValue
TlsSetValue
ResetEvent
ResumeThread
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
GetUserDefaultLCID
ExitProcess
VirtualProtect
VirtualAlloc
VirtualQuery
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
LCMapStringA
LCMapStringW
GetCPInfo
ExitThread
CreateThread
GetOEMCP
SetLastError
TlsFree
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
GetTimeZoneInformation
TerminateProcess
HeapSize
QueryPerformanceCounter
WriteFile
FlushFileBuffers
SetFilePointer
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStringTypeA
GetStringTypeW
IsValidLocale
user32
SetWindowsHookExA
RegisterClassExA
DefWindowProcA
PostQuitMessage
DispatchMessageA
TranslateMessage
GetMessageA
PostThreadMessageA
CallNextHookEx
ShowWindow
IsWindowVisible
UnhookWindowsHookEx
CreateWindowExA
UpdateWindow
LoadCursorA
ole32
StringFromIID
CoTaskMemFree
CoCreateGuid
Sections
.text Size: 136KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ