pcaui.pdb
Static task
static1
Behavioral task
behavioral1
Sample
39bbd59698c81abb8071a56c9937b252_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
39bbd59698c81abb8071a56c9937b252_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
39bbd59698c81abb8071a56c9937b252_JaffaCakes118
-
Size
42KB
-
MD5
39bbd59698c81abb8071a56c9937b252
-
SHA1
e9aace730b0458e7d557c4198ae5d36d62c30e40
-
SHA256
81b1e60c3a457a7b7f2e0d13eaa9a6167397d02c106bb09837636e0656bab1b4
-
SHA512
a155d1f05a913fbcfcfc91a138e0732018c0724b3729c5cd1d8b8222603ea02d972002a777a782dba0448f6e628daa152f0ba58064278a77ee2b992e8e446e0d
-
SSDEEP
768:0LVGGxtcLa9A1CcVPK611ty0mGDv6yOAuhO2RDV6P9zAFM/:0Dx+a9KCcVt1fy0m86yOjOqV6P9z5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39bbd59698c81abb8071a56c9937b252_JaffaCakes118
Files
-
39bbd59698c81abb8071a56c9937b252_JaffaCakes118.exe windows:6 windows x86 arch:x86
e7b4ac06320ce0185e1551e093d77248
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
TraceMessage
CheckTokenMembership
CreateWellKnownSid
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
kernel32
HeapFree
GetLastError
HeapAlloc
GetProcessHeap
LoadLibraryW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LocalFree
ProcessIdToSessionId
GetCurrentProcessId
HeapSetInformation
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
UnhandledExceptionFilter
Sleep
InterlockedExchange
msvcrt
?terminate@@YAXXZ
_except_handler4_common
_controlfp
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_wcsicmp
_wcsnicmp
_wtoi
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
memset
_wcmdln
apphelp
SdbGetEntryFlags
SdbSetEntryFlags
SdbIsNullGUID
ntdll
RtlGUIDFromString
RtlInitUnicodeString
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hopityt Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE