T:\tfTko\wpSwaIR\fRMi\llIArk.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4867a7cc95705f2aebb53027b4860f0b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4867a7cc95705f2aebb53027b4860f0b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4867a7cc95705f2aebb53027b4860f0b_JaffaCakes118
-
Size
155KB
-
MD5
4867a7cc95705f2aebb53027b4860f0b
-
SHA1
20156b6d15516f1d8ba4b56738c7c1123f8e7f9d
-
SHA256
de595e47ee21981a75876a9f639c4a5a50453f097833804b6c518d15a28048b0
-
SHA512
26d249e563d8542ac0cef7b6f3e429c880ddb3f9272340f3f8421ff7339fab148275e3515e659eb20bccffe0fc7b74a324fa3bed177f627c0c5f1fdc028224d0
-
SSDEEP
3072:yfAugO9GTFd0iWudBZ3RzsWWB/ehxLBeHmbYbK36F6jE5kgboXom:yftQd79dzhhWB/eh6QYeqF6qm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4867a7cc95705f2aebb53027b4860f0b_JaffaCakes118
Files
-
4867a7cc95705f2aebb53027b4860f0b_JaffaCakes118.exe windows:5 windows x86 arch:x86
6d4eaa5879b85a4853a17aa3254db911
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
SystemParametersInfoA
InflateRect
TileWindows
GetClassInfoA
RemovePropW
GrayStringW
CharLowerW
EnumWindows
MapVirtualKeyA
GetClassInfoExA
FindWindowExW
KillTimer
GetClassInfoW
GetKeyboardLayoutNameA
shlwapi
StrToInt64ExW
kernel32
QueryPerformanceCounter
GetCurrentProcessId
lstrcmpiW
lstrcmpW
GetWindowsDirectoryW
ExitProcess
ExitThread
OpenFileMappingW
WaitForSingleObjectEx
SetThreadContext
GetConsoleWindow
GetTickCount
gdi32
SetDIBitsToDevice
SetTextAlign
TextOutW
FillRgn
Polygon
CreateDIBSection
Exports
Exports
?lz_v___pGMPXGBOM_SJEU_@@YGXPAJPAF@Z
?_KZETSR_MCZHO__@@YGKG@Z
?r_prrS_PYat@@YGPAXH@Z
?_g_gykPOmij_emsM@@YGJPAJH@Z
Sections
.text Size: 53KB - Virtual size: 384KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idat Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pacdat Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ