H:\BAOWODKA\EAKOPTMS\TTODXBDEM\ERSEE.PDB
Static task
static1
Behavioral task
behavioral1
Sample
5df7174dd9d5af46d64b23d4895c3030_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5df7174dd9d5af46d64b23d4895c3030_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5df7174dd9d5af46d64b23d4895c3030_JaffaCakes118
-
Size
328KB
-
MD5
5df7174dd9d5af46d64b23d4895c3030
-
SHA1
70338a02b881084e5a978e54572216c1b225eee8
-
SHA256
b435ebebe38bdbe6a0ef8d0a2005bf627998e5e949874a2d0872e198ed2cfc43
-
SHA512
d58c7eecda846891ea196b83d73e20759c28a2252ac24038d80c5c193449f79f6f391cb2714c1151f7599d8f6ebe209ef9576db38da62206281c569dfab29903
-
SSDEEP
6144:I5VCwfjnMpbyTUGLz3G3Uqs+AQZImUMZ25pDRCgplXVwg:+VCwObuuUqs+p7URDRCgO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5df7174dd9d5af46d64b23d4895c3030_JaffaCakes118
Files
-
5df7174dd9d5af46d64b23d4895c3030_JaffaCakes118.exe windows:4 windows x86 arch:x86
fedc3b9fc3b1a827faf71a9642079c4d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
ShowWindow
BlockInput
BeginPaint
GetClassInfoA
PostQuitMessage
GetUpdateRect
UnregisterClassA
IsIconic
SendNotifyMessageW
DrawStateW
OemToCharA
GetMenuState
CreateDesktopA
DlgDirListW
GetClassInfoExA
AppendMenuA
EnumDisplaySettingsExA
FlashWindowEx
CreateWindowExA
ChangeClipboardChain
RegisterWindowMessageA
LoadBitmapW
RegisterClassA
SetForegroundWindow
SetClipboardData
InternalGetWindowText
DefMDIChildProcA
LookupIconIdFromDirectoryEx
DispatchMessageA
TrackPopupMenu
TranslateMDISysAccel
SetPropA
SetWindowPos
GetMenuStringW
MonitorFromWindow
DefDlgProcA
EnumPropsA
GetWindowModuleFileNameA
MapVirtualKeyA
MessageBoxA
GetParent
InsertMenuA
RemovePropA
DdeQueryConvInfo
DefWindowProcW
WindowFromDC
GetDC
ChangeDisplaySettingsW
DestroyWindow
DdeAddData
EqualRect
MessageBoxW
ChangeMenuA
AdjustWindowRectEx
RegisterClassExA
SetUserObjectInformationW
OemToCharBuffA
CharPrevA
wininet
GopherCreateLocatorA
FtpPutFileW
FtpCommandW
GopherFindFirstFileA
kernel32
GetStringTypeW
GetACP
GetFileType
VirtualAllocEx
GetProcAddress
GetTempFileNameA
EnterCriticalSection
UnhandledExceptionFilter
HeapReAlloc
GetPrivateProfileIntA
TlsSetValue
MultiByteToWideChar
FreeEnvironmentStringsW
FlushFileBuffers
CompareStringA
DebugBreak
GetModuleFileNameA
SetLastError
GetProfileIntW
GetCurrentThreadId
OpenMutexA
ExpandEnvironmentStringsA
VirtualFree
LCMapStringW
LocalCompact
lstrcmpi
TlsGetValue
HeapAlloc
TerminateProcess
GetLastError
RtlUnwind
GetEnvironmentVariableA
CloseHandle
LCMapStringA
ExitProcess
WaitNamedPipeW
GetCommandLineA
SetHandleCount
WriteConsoleOutputCharacterW
DuplicateHandle
TlsAlloc
DeleteCriticalSection
QueryPerformanceCounter
WideCharToMultiByte
InterlockedIncrement
GetOEMCP
GetTickCount
GetModuleHandleA
GetSystemTime
HeapDestroy
LoadLibraryA
SetLocaleInfoA
VirtualQuery
GetStartupInfoA
GetCurrentProcess
lstrcpyA
InitializeCriticalSection
GetLocalTime
SetStdHandle
GetCurrentProcessId
RtlFillMemory
TlsFree
SetConsoleWindowInfo
ReadFile
GetStringTypeA
SetEnvironmentVariableA
SetConsoleCursorPosition
GetEnvironmentStrings
GetSystemTimeAsFileTime
GetStdHandle
UnlockFileEx
GetVersion
GetEnvironmentStringsW
lstrcmp
WriteFile
GlobalHandle
FreeEnvironmentStringsA
GetNamedPipeInfo
IsBadWritePtr
HeapCreate
GetCPInfo
InterlockedExchange
FoldStringW
SetFilePointer
GetCurrentThread
InterlockedDecrement
CompareStringW
LeaveCriticalSection
SetCurrentDirectoryW
HeapFree
VirtualAlloc
CreateMutexA
GetTimeZoneInformation
comctl32
ImageList_Duplicate
ImageList_Replace
ImageList_GetImageRect
CreateToolbarEx
ImageList_Destroy
InitCommonControlsEx
ImageList_DrawIndirect
ImageList_Copy
ImageList_ReplaceIcon
ImageList_Remove
ImageList_AddMasked
DestroyPropertySheetPage
CreatePropertySheetPageA
ImageList_AddIcon
DrawStatusTextA
shell32
SHGetDataFromIDListA
SHInvokePrinterCommandW
SHChangeNotify
SHBrowseForFolderA
Sections
.text Size: 116KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 96KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 96KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ