d:\Projects\netPanelPrj\src\Remove\Release\Remove.pdb
Static task
static1
Behavioral task
behavioral1
Sample
20ec941a8b42991a203ddc8eac4c318d_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
20ec941a8b42991a203ddc8eac4c318d_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
20ec941a8b42991a203ddc8eac4c318d_JaffaCakes118
-
Size
180KB
-
MD5
20ec941a8b42991a203ddc8eac4c318d
-
SHA1
3ccfee57cddbd56127b82404133cbd55298d9faa
-
SHA256
9132fb350eaf7d54d9139b65e703c56cb8ee65d015f3ca8af9213988236c9730
-
SHA512
2b960f682834dc1292a116ede0cc994436a4775e637c46641502746f69797fcf166cb1fa0ff85c4444db080104c8f0bbb30c9f360a219479fb65ffeb22c7d7fd
-
SSDEEP
3072:nV0kyss2FzkdrfnrmWr2Gigxv3Fr8GWTKSpAicPUjzEJC2UcRhf:nny/2qrmk2Gi4v3qGWT8xPUc/Nh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20ec941a8b42991a203ddc8eac4c318d_JaffaCakes118
Files
-
20ec941a8b42991a203ddc8eac4c318d_JaffaCakes118.exe windows:4 windows x86 arch:x86
f30cd5ee91735dc82fe7c084d34d1141
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateMutexA
GetVersionExA
WaitForSingleObject
DeleteFileA
CloseHandle
GetCurrentProcess
ExitProcess
RemoveDirectoryA
GetLastError
GetModuleFileNameA
SetCurrentDirectoryA
Sleep
SetEndOfFile
GetLocaleInfoW
FlushFileBuffers
SetStdHandle
VirtualQuery
GetSystemInfo
VirtualProtect
SetFilePointer
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
FindClose
FindNextFileA
FindFirstFileA
ReadFile
GetFileSize
CreateFileA
GlobalFree
GlobalAlloc
CreateSemaphoreA
ReleaseSemaphore
GetSystemDirectoryA
WriteFile
GetVolumeInformationA
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleHandleA
OpenProcess
TerminateProcess
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
ExitThread
GetCurrentThreadId
TlsSetValue
TlsGetValue
CreateThread
GetStartupInfoA
GetCommandLineA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
GetCPInfo
TlsFree
SetLastError
TlsAlloc
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
UnhandledExceptionFilter
HeapReAlloc
HeapSize
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
GetACP
GetOEMCP
VirtualAlloc
IsBadWritePtr
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
user32
SetWindowTextA
EndDialog
CheckDlgButton
SendMessageA
ShowWindow
PostMessageA
EnableWindow
UpdateWindow
MessageBoxA
LoadStringA
RegisterClassA
CreateWindowExA
SetTimer
GetMessageA
TranslateMessage
DispatchMessageA
KillTimer
GetDlgItem
PostQuitMessage
DialogBoxParamA
SetWindowLongA
GetWindowRect
GetDesktopWindow
MoveWindow
SetForegroundWindow
GetWindowLongA
IsDlgButtonChecked
DefWindowProcA
gdi32
CreateBrushIndirect
SetTextColor
SetBkColor
ole32
CoInitialize
CoUninitialize
ws2_32
WSACleanup
closesocket
shutdown
connect
socket
recv
WSAGetLastError
send
gethostbyname
htons
WSAStartup
advapi32
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
OpenProcessToken
FreeSid
EqualSid
LookupAccountSidA
AllocateAndInitializeSid
GetTokenInformation
RegSetValueExA
RegCreateKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegCloseKey
shell32
SHGetPathFromIDListA
SHFileOperationA
SHGetSpecialFolderLocation
Sections
.text Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ