EhShell.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1b1bfa83aae4145c259421b1b4efbf50_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1b1bfa83aae4145c259421b1b4efbf50_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
1b1bfa83aae4145c259421b1b4efbf50_JaffaCakes118
-
Size
98KB
-
MD5
1b1bfa83aae4145c259421b1b4efbf50
-
SHA1
a139fa79f4e2bc8b1052ae8e79392c632dbda1e1
-
SHA256
c0519218f5df04a7ab3e0825115268f431dc014d1b17f63d3cafd6126b5dc0f6
-
SHA512
0d10339586c5544512cfde70e10eb144c9d679f92a93171b4799c3007e047ad22ad1d634063372253cf02664ed7bf9a8b02d98788a67eed39f3662a237d91f0f
-
SSDEEP
3072:iJ0KRbUBfVQgJL0kWJ7aWXW3/woYTPTZ8bZu:iucUByyLY7aQEwhT98b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b1bfa83aae4145c259421b1b4efbf50_JaffaCakes118
Files
-
1b1bfa83aae4145c259421b1b4efbf50_JaffaCakes118.exe windows:6 windows x86 arch:x86
cd0d8994a9357f264a34222f773f2a21
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetTickCount
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetProcAddress
EncodeSystemPointer
CloseHandle
RaiseException
GetModuleFileNameW
SetCurrentDirectoryW
LoadLibraryW
FreeLibrary
GetLastError
GetStartupInfoW
msvcrt
_controlfp
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
??_U@YAPAXI@Z
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
??3@YAXPAX@Z
_unlock
memset
free
??2@YAPAXI@Z
malloc
??_V@YAXPAX@Z
ole32
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
shlwapi
PathRemoveFileSpecW
mscoree
CorBindToCurrentRuntime
advapi32
SetSecurityDescriptorOwner
InitializeAcl
AddAccessAllowedAce
GetAce
AddAce
LookupAccountNameW
GetTokenInformation
SetSecurityDescriptorGroup
IsValidSid
GetLengthSid
CopySid
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
CreateWellKnownSid
LookupAccountSidW
OpenProcessToken
SetSecurityDescriptorDacl
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qqueqja Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE