c:\C++\_networking\Backdoors\BBack_\Release\BBack_.pdb
Static task
static1
Behavioral task
behavioral1
Sample
47a64a0ea888a7fccdf1f4a47d92a69d_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
47a64a0ea888a7fccdf1f4a47d92a69d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
47a64a0ea888a7fccdf1f4a47d92a69d_JaffaCakes118
-
Size
48KB
-
MD5
47a64a0ea888a7fccdf1f4a47d92a69d
-
SHA1
83de6295939b6fb5fcd996ba6aee06d99b78bfbf
-
SHA256
b5655396238498f1fd6e83f4244f7d35266a16efb877383a4a7ab1fa44911d2e
-
SHA512
5bb3eeec9c09cb4eac705ee3bd822c02f961cf88e676b73d2a3ff3ad1542c8b468f7de60cdd9633261caccd01bffdaa731a0d2577f4ea3be22a614c904d1050c
-
SSDEEP
768:RL4IvHtp5YdkjvNdkmqm2MXtk8ONSXRlorxNwrD+:RLBvNp5IoumqmX2/SXA1gD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 47a64a0ea888a7fccdf1f4a47d92a69d_JaffaCakes118
Files
-
47a64a0ea888a7fccdf1f4a47d92a69d_JaffaCakes118.exe windows:4 windows x86 arch:x86
d4a7f7297bd6bf7de653f7ff5946d08d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersionExA
GetComputerNameA
Sleep
TerminateProcess
WriteFile
ReadFile
PeekNamedPipe
CloseHandle
GetCurrentDirectoryA
GetStartupInfoA
CreatePipe
WinExec
CreateFileA
GetTempPathA
ExitProcess
LCMapStringW
LCMapStringA
lstrcmpiA
GetSystemDirectoryA
GetTickCount
GetCommandLineA
CreateProcessA
CopyFileA
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetCPInfo
GetOEMCP
GetACP
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
VirtualQuery
InterlockedExchange
RtlUnwind
LoadLibraryA
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetLastError
HeapSize
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapFree
HeapAlloc
GetModuleHandleA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetProcAddress
GetCurrentProcess
GetStdHandle
UnhandledExceptionFilter
user32
wsprintfA
advapi32
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
wsock32
send
recv
socket
ioctlsocket
WSAGetLastError
htons
inet_ntoa
connect
select
shutdown
closesocket
WSACleanup
WSAStartup
gethostname
gethostbyname
wininet
InternetOpenA
InternetCloseHandle
InternetQueryOptionA
InternetReadFile
InternetOpenUrlA
Sections
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ