conime.pdb
Static task
static1
Behavioral task
behavioral1
Sample
44676da811374f8abf43dccae246171f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
44676da811374f8abf43dccae246171f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
44676da811374f8abf43dccae246171f_JaffaCakes118
-
Size
70KB
-
MD5
44676da811374f8abf43dccae246171f
-
SHA1
2543fef85d040ec92c7e83867d2a3d184b62c1c4
-
SHA256
19947c1c26454eccc45e11638a4ba8051d14605b120ad365cefcba53ec309e9e
-
SHA512
9017dd9b2d7c04f8087f643b4fa46a1a9588a674de703cc732787261b72cde2663d2c47f65a4477ff56c81df57c7eb5cbe66a80ad956278e0d0e229979619319
-
SSDEEP
768:iqu3FG11xvqrIKA/lGK+cZahN/ej+1E1cgr0D+2Hfu3p51XBka0zTA3Pisc:iqaFJJA/MxOc1owa0z03P2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44676da811374f8abf43dccae246171f_JaffaCakes118
Files
-
44676da811374f8abf43dccae246171f_JaffaCakes118.exe windows:5 windows x86 arch:x86
d23314c5bd8326712a667023f475bd80
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetModuleHandleA
RegisterConsoleIME
UnregisterConsoleIME
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
lstrlenW
lstrcpyW
lstrcatW
lstrcpynW
WideCharToMultiByte
GetSystemDirectoryW
SetCurrentDirectoryW
OpenEventW
SetEvent
CloseHandle
LocalAlloc
LocalFree
GetStartupInfoA
GetCurrentThreadId
user32
IsWindowEnabled
ActivateKeyboardLayout
PostMessageW
GetKeyboardLayoutList
SendMessageTimeoutW
PostQuitMessage
SetForegroundWindow
DefWindowProcW
EnableWindow
DestroyWindow
GetKeyState
GetKeyboardLayoutNameW
GetMessageW
TranslateMessage
DispatchMessageW
LoadStringW
LoadIconW
LoadCursorW
RegisterClassW
GetSystemMetrics
CreateWindowExW
UnregisterClassW
AttachThreadInput
ntdll
RtlLeaveCriticalSection
NtOpenProcessToken
RtlUnicodeToMultiByteSize
NtQueryInformationToken
NtClose
RtlInitializeCriticalSection
NtQueryVirtualMemory
RtlUnwind
RtlCopyLuid
RtlEnterCriticalSection
imm32
ImmGetContext
ImmReleaseContext
ImmGetConversionStatus
ImmGetGuideLineW
ImmSetConversionStatus
ImmSimulateHotKey
ImmGetIMEFileNameW
ImmEscapeW
ImmDisableTextFrameService
ImmGetOpenStatus
ImmNotifyIME
ImmGetCandidateListW
ImmGetCompositionStringW
ImmSetActiveContextConsoleIME
ImmTranslateMessage
ImmCallImeConsoleIME
ImmGetProperty
ImmCreateContext
ImmAssociateContext
ImmSetOpenStatus
ImmDestroyContext
ImmIsIME
gdi32
GetStockObject
msvcrt
_controlfp
__set_app_type
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 46KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE