x:\PROJETOS\C++\HFLauncher\release\start.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4cab4a2ca68c55b64a958acba7a55584_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4cab4a2ca68c55b64a958acba7a55584_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4cab4a2ca68c55b64a958acba7a55584_JaffaCakes118
-
Size
352KB
-
MD5
4cab4a2ca68c55b64a958acba7a55584
-
SHA1
4fbf11aab8cd2ee6ff47225696755b7247f3a1f6
-
SHA256
44b6bde9b84259f3e270bf5f439806fa4049fae2b1289d059123e177d1047eff
-
SHA512
b1e5b6ce5c0403ddfc902b6a3c050f016fac5e91800ec375c0702c16cef1ec4350dd78b1c4e77b5e34df6f4cb3d3b43e958760d290a57a9ccb7ba5dbd92fd787
-
SSDEEP
6144:6hy18T/RO/9jBwm5yTiMFWDpurRQKwAEW1lMfvnbCqVDdhlD:6WC/W9im50TWDpuyKwjW1UnOeRD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4cab4a2ca68c55b64a958acba7a55584_JaffaCakes118
Files
-
4cab4a2ca68c55b64a958acba7a55584_JaffaCakes118.exe windows:4 windows x86 arch:x86
62685734ecb96868f076c89501ce85f2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
ExitProcess
GetCurrentDirectoryW
CreateProcessW
GetLocaleInfoW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCurrentDirectoryA
GetFullPathNameA
FlushFileBuffers
SetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
HeapSize
VirtualAlloc
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameW
GetModuleFileNameA
WriteFile
GetModuleHandleA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
RaiseException
FindFirstFileA
GetDriveTypeA
FindClose
SetFilePointer
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateThread
GetCurrentThreadId
ExitThread
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
SleepEx
GetProcAddress
FreeLibrary
LoadLibraryA
GetSystemDirectoryA
CloseHandle
WaitForSingleObject
FormatMessageA
GetTickCount
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
Sleep
ExpandEnvironmentStringsA
WideCharToMultiByte
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetSystemTimeAsFileTime
SetEndOfFile
user32
DialogBoxParamW
DestroyWindow
DefWindowProcW
BeginPaint
EndPaint
PostQuitMessage
EndDialog
LoadStringW
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
ShowWindow
UpdateWindow
wldap32
ord46
ord41
ord27
ord301
ord33
ord200
ord79
ord35
ord32
ord30
ord26
ord22
ord211
ord143
ord60
ord50
ws2_32
WSACleanup
WSAStartup
WSAGetLastError
closesocket
socket
recv
send
getsockname
ntohs
bind
htons
getsockopt
getpeername
setsockopt
connect
WSASetLastError
inet_addr
gethostbyname
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
sendto
recvfrom
accept
listen
__WSAFDIsSet
select
ioctlsocket
gethostname
Sections
.text Size: 284KB - Virtual size: 281KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ