RmClient.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1c67c1b636fd9ef7ab456d520ae3c6ed_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1c67c1b636fd9ef7ab456d520ae3c6ed_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1c67c1b636fd9ef7ab456d520ae3c6ed_JaffaCakes118
-
Size
41KB
-
MD5
1c67c1b636fd9ef7ab456d520ae3c6ed
-
SHA1
dcaf121b3c7b98b51392203e055462f83cb676c9
-
SHA256
0b78d124fdcc753f2dea55d2bf1255941ed66fadec1ad43b90a9c378c0899e1e
-
SHA512
e5b02fdacbc795372bdc12021e43119e9b17eae4f807a1316213ca6a62051fa644c1018adfca60c2363217a18f528147ed7a81c64029b3179434db10b3ce95b0
-
SSDEEP
768:4D7oR1Mfb0T31CBzSzuQ/DEOLUG+xwLNQmZzjDcMDjS:J1cOIIxRKmZzjHD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c67c1b636fd9ef7ab456d520ae3c6ed_JaffaCakes118
Files
-
1c67c1b636fd9ef7ab456d520ae3c6ed_JaffaCakes118.exe windows:6 windows x86 arch:x86
473324e98ef235265a8cd773074dcf74
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
CreateProcessAsUserW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
kernel32
CloseHandle
GetOverlappedResult
WaitForSingleObjectEx
ReadFile
ResetEvent
GetLastError
CreateEventW
WriteFile
SetNamedPipeHandleState
Sleep
CreateFileW
GetSystemWindowsDirectoryW
GetCurrentProcess
HeapSetInformation
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
UnhandledExceptionFilter
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
msvcrt
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
wprintf
_exit
memset
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_cexit
__wgetmainargs
memcpy
ntdll
RtlFreeHeap
RtlAllocateHeap
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE