c:\src\Pstools\psexec\EXE\Release\psexec.pdb
Static task
static1
Behavioral task
behavioral1
Sample
24efa47ccee0b066bfc83e874f882878_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
24efa47ccee0b066bfc83e874f882878_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
24efa47ccee0b066bfc83e874f882878_JaffaCakes118
-
Size
370KB
-
MD5
24efa47ccee0b066bfc83e874f882878
-
SHA1
0196bb0fa14ab371d8a8a4594330e39a5c26d339
-
SHA256
7c88e235e9a5c54ab032493fd3048cba94615d4fc58d2f1876ecb10ca4eca709
-
SHA512
ae05cc69602aa76d705c9234bc1b329752d4a75e57e92fe3d5cde0b71dcb496ba34ba28411cce05a78dea67d1c67bbbe71f99a5342b09e2ee27f4a9336614568
-
SSDEEP
6144:Rt2pNUf3LmtVL7HOyMxKGwDJ7Cv1J1+grY8L6IYDa2IyKWPZIoy/38vtdwr9iWMT:2paf3LgvgrwurY8LOvIps+/m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 24efa47ccee0b066bfc83e874f882878_JaffaCakes118
Files
-
24efa47ccee0b066bfc83e874f882878_JaffaCakes118.exe windows:5 windows x86 arch:x86
7888f345881919705e95d7a5fef2273c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
netapi32
NetApiBufferFree
NetServerEnum
ws2_32
WSAStartup
gethostname
inet_ntoa
gethostbyname
mpr
WNetAddConnection2W
WNetCancelConnection2W
kernel32
MultiByteToWideChar
GetCurrentProcess
GetVersion
GetModuleFileNameW
SetEvent
ConnectNamedPipe
GetFileAttributesW
DisconnectNamedPipe
ReadConsoleW
ReadFile
GetFileTime
WaitNamedPipeW
SetFileAttributesW
CopyFileW
WaitForMultipleObjects
SetConsoleTitleW
DuplicateHandle
GetCurrentProcessId
WaitForSingleObject
FormatMessageA
SetConsoleCtrlHandler
CreateEventW
GetExitCodeProcess
ResumeThread
SetProcessAffinityMask
GetEnvironmentVariableW
GetFullPathNameW
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeA
SetFilePointer
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetComputerNameW
GetSystemDirectoryW
DeleteFileW
FindResourceW
LoadResource
LockResource
SizeofResource
TransactNamedPipe
LoadLibraryExW
GetStdHandle
WriteFile
FreeLibrary
CreateFileW
CloseHandle
GetTickCount
Sleep
SetLastError
GetLastError
SetEnvironmentVariableA
GetCommandLineW
LocalAlloc
GetModuleHandleW
LocalFree
SetPriorityClass
LoadLibraryW
GetProcAddress
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
GetLocaleInfoW
GetTimeZoneInformation
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
SetNamedPipeHandleState
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
ExitThread
GetCurrentThreadId
CreateThread
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ExitProcess
DeleteCriticalSection
FatalAppExitA
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
GetModuleFileNameA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
GetConsoleCP
RtlUnwind
CreateFileA
FlushFileBuffers
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetStringTypeW
LCMapStringA
user32
LoadCursorW
SetCursor
SetWindowTextW
SendMessageW
EndDialog
GetSysColorBrush
GetDlgItem
DialogBoxIndirectParamW
InflateRect
gdi32
SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetDeviceCaps
comdlg32
PrintDlgW
advapi32
GetAce
CreateProcessAsUserW
OpenProcessToken
AdjustTokenPrivileges
DeleteService
ControlService
OpenSCManagerW
OpenServiceW
StartServiceW
QueryServiceStatus
CreateServiceW
CloseServiceHandle
RegCreateKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
AllocateAndInitializeSid
GetTokenInformation
GetLengthSid
SetTokenInformation
GetSecurityInfo
InitializeAcl
AddAce
AddAccessAllowedAce
SetSecurityInfo
FreeSid
LsaOpenPolicy
LsaEnumerateAccountRights
LookupPrivilegeValueW
LsaFreeMemory
LsaClose
Sections
.text Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ