SBUnattend.pdb
Behavioral task
behavioral1
Sample
2f7aa79248a6dff9e3cfdaeee13a34fc_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2f7aa79248a6dff9e3cfdaeee13a34fc_JaffaCakes118.exe
Resource
win10v2004-20240708-en
General
-
Target
2f7aa79248a6dff9e3cfdaeee13a34fc_JaffaCakes118
-
Size
156KB
-
MD5
2f7aa79248a6dff9e3cfdaeee13a34fc
-
SHA1
58638d93f136096ca334df1a6cf546d0cd61d3cd
-
SHA256
7e3aee775ef93fd1fd43c6ea48c8e44447805a98fad428c3e16b1f0b08eb1553
-
SHA512
e3aabf07329db1f56a1b56329e55a29103b0df516b83e37542209ab23b7bb9f0749b9c2dda3a8534b6e69ab90a9a406c1cda352579506f030d12c47842189e7b
-
SSDEEP
3072:T8JhWodp8G7FKCOCtq1aIpw02QroLWyY7UR++13Lx1ZLo+zZR:Qdp8G5xOZ1sx1SyyUR++NZLo+zZR
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f7aa79248a6dff9e3cfdaeee13a34fc_JaffaCakes118
Files
-
2f7aa79248a6dff9e3cfdaeee13a34fc_JaffaCakes118.exe windows:6 windows x86 arch:x86
fdd32489eb7124c4c42e24ecdfb954af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
UnhandledExceptionFilter
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
lstrcmpW
GetLastError
WritePrivateProfileStringW
HeapFree
GetProcessHeap
GetTickCount
msvcrt
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
wcstok
_vsnwprintf
shlwapi
UrlEscapeW
shell32
SHGetFolderPathW
wdscore
CurrentIP
WdsSetupLogMessageW
ConstructPartialMsgVW
advapi32
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 730B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE