C:\svn\montiera\dvlp\bin\bbyln\esrv.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2a266b40bc27081d1ff1a6969cdb1299_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2a266b40bc27081d1ff1a6969cdb1299_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2a266b40bc27081d1ff1a6969cdb1299_JaffaCakes118
-
Size
416KB
-
MD5
2a266b40bc27081d1ff1a6969cdb1299
-
SHA1
c958a80921e569e6d5639157c6057d21117f40a0
-
SHA256
7ad8a3110ba5480b3828ce54f9fe8f7ea86ef52abefcf37f52aa7d6b13e825f6
-
SHA512
e0f09fe7cf82b124d96289c4a7ec9773eda2ae07089187342af4139c1a7b99427c2d1271a423b80cb6758887606ae0ca1754bd5052ea595f73f9b133b649c67a
-
SSDEEP
12288:kUbXxywOAEqDIHG8yoaaMpH6Dpok3W9Ac:Mq+yoaayspNmic
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a266b40bc27081d1ff1a6969cdb1299_JaffaCakes118
Files
-
2a266b40bc27081d1ff1a6969cdb1299_JaffaCakes118.exe windows:5 windows x86 arch:x86
7bc2a929aca87b0f8ae8bcb5ce98b7ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
sensapi
IsNetworkAlive
kernel32
InterlockedIncrement
lstrlenA
RaiseException
EnterCriticalSection
LeaveCriticalSection
lstrcmpiA
GetModuleFileNameA
IsDBCSLeadByte
Sleep
CreateThread
CreateEventA
GetModuleHandleW
GetCurrentThreadId
SetEvent
ExitProcess
GetTickCount
FreeLibrary
FindResourceA
LoadLibraryExA
GetCommandLineA
FlushInstructionCache
GetCurrentProcess
SetLastError
LoadLibraryA
SetFilePointer
CreateDirectoryA
GetTempPathA
MoveFileExA
GetTempFileNameA
InitializeCriticalSection
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpA
MulDiv
ReleaseMutex
ResetEvent
CreateMutexA
GetVersionExA
GetEnvironmentVariableA
SetEnvironmentVariableA
CreateFileA
HeapReAlloc
HeapSize
FindResourceExW
InitializeCriticalSectionAndSpinCount
CreateFileW
WriteConsoleW
FlushFileBuffers
SetStdHandle
LoadLibraryW
LCMapStringW
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
GetStdHandle
GetTimeZoneInformation
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapCreate
GetSystemTimeAsFileTime
GetStartupInfoW
HeapSetInformation
VirtualQuery
GetSystemInfo
VirtualProtect
GetDateFormatA
GetTimeFormatA
RtlUnwind
EncodePointer
DecodePointer
LocalFree
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
WaitForSingleObject
GetFileTime
InterlockedDecrement
lstrlenW
MultiByteToWideChar
FileTimeToLocalFileTime
FileTimeToSystemTime
WriteFile
WideCharToMultiByte
CloseHandle
GetModuleHandleA
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
GetLastError
CompareStringW
GetProcessHeap
GetProcAddress
HeapFree
HeapAlloc
HeapDestroy
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
user32
ShowWindow
SetWindowPos
CharNextW
PostThreadMessageA
CharUpperA
UnregisterClassA
DestroyWindow
SetWindowLongA
IsWindow
GetClassInfoExA
LoadCursorA
LoadIconA
CharNextA
SendMessageA
CallWindowProcA
GetWindowLongA
SetWindowTextA
FillRect
MsgWaitForMultipleObjects
PeekMessageA
GetWindowTextLengthA
GetWindowTextA
CreateAcceleratorTableA
DestroyAcceleratorTable
GetDesktopWindow
SetFocus
GetFocus
GetWindow
BeginPaint
EndPaint
RegisterClassExA
ReleaseCapture
GetClassNameA
GetDlgItem
GetParent
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetClientRect
MoveWindow
GetSysColor
GetMessageA
TranslateMessage
DispatchMessageA
KillTimer
RegisterWindowMessageA
PostQuitMessage
CreateWindowExA
DefWindowProcA
gdi32
BitBlt
GetStockObject
GetObjectA
CreateSolidBrush
GetDeviceCaps
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
advapi32
RegQueryInfoKeyW
RegQueryValueExA
RegQueryInfoKeyA
RegDeleteValueA
RegEnumKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
shell32
ShellExecuteExA
Shell_NotifyIconA
SHGetSpecialFolderPathW
ord165
SHGetSpecialFolderPathA
SHGetFileInfoA
ole32
OleRun
OleUninitialize
OleInitialize
CoGetClassObject
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
StringFromCLSID
CoTaskMemAlloc
CoTaskMemRealloc
CoInitialize
CoUninitialize
CoRevokeClassObject
CoCreateGuid
CoRegisterClassObject
StringFromGUID2
CoAddRefServerProcess
CoReleaseServerProcess
CoInitializeEx
CreateStreamOnHGlobal
OleLockRunning
oleaut32
LoadRegTypeLi
GetErrorInfo
SafeArrayLock
OleCreateFontIndirect
SysStringByteLen
SysAllocStringByteLen
VarBstrCat
DispCallFunc
RegisterTypeLi
UnRegisterTypeLi
VarUI4FromStr
LoadTypeLi
SafeArrayUnlock
SafeArrayCopy
SafeArrayDestroy
SysAllocStringLen
VariantCopy
SysAllocString
VariantClear
VariantInit
SysFreeString
VarBstrCmp
SysStringLen
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetVartype
SafeArrayGetDim
shlwapi
SHGetValueA
PathAppendA
PathRenameExtensionA
PathFindFileNameA
PathFindExtensionA
PathIsURLW
StrStrW
StrToIntW
Sections
.text Size: 239KB - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 14KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
98� Size: 83KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE