c:\Users\Ivan\Documents\generic_exe\Release\UnInstaller.pdb
Static task
static1
Behavioral task
behavioral1
Sample
44d405b86231505749028e9eef49c883_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
44d405b86231505749028e9eef49c883_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
44d405b86231505749028e9eef49c883_JaffaCakes118
-
Size
344KB
-
MD5
44d405b86231505749028e9eef49c883
-
SHA1
8d3f3208af1c00258e1513cbcd1732412443ffc3
-
SHA256
1c41b804934037a4c839a6c4139d16a952d8adb579867732b4765f5597cbb62f
-
SHA512
87994b18c9e6314f09ddf3edeab30a669c74ac46a7abc112f83440d5f082a6ad7d474db6b46f965e32a324abe540869611081239f30b8120951520a1de9b2e47
-
SSDEEP
6144:+ehHpixGxn1fEtRLyLF9UaaldtuhFQ7JE4oJ:+ehQg1fEtRmLjUfdtu/2TA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44d405b86231505749028e9eef49c883_JaffaCakes118
Files
-
44d405b86231505749028e9eef49c883_JaffaCakes118.exe windows:5 windows x86 arch:x86
516e7c9d6ca9c57694b18863f5e893dc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyW
kernel32
LocalFree
MultiByteToWideChar
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
CloseHandle
SetEvent
WaitForSingleObject
GetModuleFileNameW
CreateEventW
CreateProcessW
DeleteFileW
RemoveDirectoryW
CreateFileA
WriteFile
InitializeCriticalSection
InterlockedCompareExchange
GetProcessHeap
SetEndOfFile
GetModuleHandleA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
InterlockedExchange
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLastError
HeapFree
InterlockedDecrement
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetSystemTimeAsFileTime
GetStartupInfoW
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
Sleep
InterlockedIncrement
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
ExitProcess
GetModuleFileNameA
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointer
ReadFile
FlushFileBuffers
RtlUnwind
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetLocaleInfoW
CreateFileW
user32
MessageBoxW
shell32
SHGetSpecialFolderPathW
shlwapi
PathRemoveFileSpecW
wininet
InternetReadFile
InternetConnectA
InternetOpenW
HttpSendRequestW
InternetOpenUrlW
InternetCloseHandle
HttpOpenRequestA
ws2_32
WSACleanup
WSAStartup
Sections
.text Size: 206KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ