V:\yveBoYIYq\wXMPRYa\fpQGOysNbYa\iksrdOO\KHFxhNuzq.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5a8649a2f98137f777ff71a0252e19bb_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5a8649a2f98137f777ff71a0252e19bb_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5a8649a2f98137f777ff71a0252e19bb_JaffaCakes118
-
Size
171KB
-
MD5
5a8649a2f98137f777ff71a0252e19bb
-
SHA1
f4fec2fafb7b16b8df746361fc6cf6bb4fd56fb4
-
SHA256
29774d13d0e0d74f767ea8b2b70fab35d686d1c6359d0b30dd2dcfb62dfcdc3d
-
SHA512
b9617f55e032b12524854a1b6e9ed00f5841f307838da6c3bcd707751e484315965ab892c07e7c01e51461ef53f5d42221feeac97ea9379bd281891ef19df56e
-
SSDEEP
3072:On3ObbQgBhw8ZHSfYEeqEVo10n69/LUKfVlwOieJHh7M4rh3q4vDxrLmkG80ZNSB:On3OvZ5yz1e69DUK/NTJB7M413qSD5Jv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a8649a2f98137f777ff71a0252e19bb_JaffaCakes118
Files
-
5a8649a2f98137f777ff71a0252e19bb_JaffaCakes118.exe windows:5 windows x86 arch:x86
e31deef908b0df28459400a422a22332
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
gdi32
ExcludeClipRect
GetSystemPaletteEntries
SetViewportExtEx
GetTextCharsetInfo
SetWindowExtEx
GetRgnBox
LineTo
GetTextExtentExPointW
SetPixel
ExtTextOutA
RoundRect
RectInRegion
SetBkColor
kernel32
lstrlenW
FreeResource
SetThreadLocale
lstrcmpiW
GetDateFormatA
ClearCommBreak
CompareStringW
GlobalHandle
SearchPathA
AreFileApisANSI
SetCommTimeouts
ReadFile
SetPriorityClass
lstrcpyA
CreateNamedPipeW
ntdll
memset
strcspn
msvcrt
exit
shlwapi
UrlGetPartW
PathMatchSpecA
user32
GetScrollRange
ValidateRect
IntersectRect
SetFocus
FindWindowExA
DrawTextA
LoadIconA
SetMenuItemInfoW
IsWindowVisible
GetClipCursor
IsMenu
ScrollWindowEx
AdjustWindowRectEx
GetMenuStringA
GetSystemMenu
SendMessageTimeoutA
OpenDesktopW
DrawTextW
SetWindowLongA
CheckDlgButton
GetDlgItemTextA
GetMenuItemID
RedrawWindow
InsertMenuW
CreateWindowExW
GetClassInfoA
CreateIconIndirect
EndDialog
KillTimer
Exports
Exports
?xyisgbl@@YGJE@Z
?mvfkmc_YC_R_@@YGEHK@Z
?xagm_OTR_Zg__g_c_ttS@@YGPAMPAEH@Z
?vjVTBBVjvaozvcDZYL_@@YGGPAKI@Z
?__BOMFIIKIW@@YGMH@Z
?oS_WUKLEGJAS_RD@@YGJE@Z
?_ALQ__HWPPRx_ef@@YGXPAEM@Z
?jw_bvshT_YBLY@@YGEEN@Z
?pukrqp_aF_PJVY_ZTy_zM@@YGPAEED@Z
?tkers__o__uup_xZRWrkme@@YGM_N@Z
?EGET_IpK_WREJ_I_@@YGXEH@Z
?iuzvhrdrRHP@@YGXF@Z
?_imggnbq_w_@@YGGJE@Z
?dbbnkhjli_h@@YGPAXPAHH@Z
?XDFYJTKxzcbhWHCLZn_b@@YGPAJGPAH@Z
?_vk_hxktV@@YGHD@Z
?dshyZCuvzXHWKS_UU_@@YGHIF@Z
?__oggmpoxuf_ypkm@@YGHMPAH@Z
?Zcwneqjnz_Eoicwcti_@@YGEPAKPAI@Z
?elvQB__UFPRPGCo@@YGJPAG@Z
?Suv_tu_Q_ZIResnfbiq_@@YGPAME@Z
?O_O_jkchv_k@@YGMH@Z
?tglhFqsm_EPD@@YGXGE@Z
?_UL_MCr___v__sVT_X_@@YGX_NJ@Z
?_QXCYtmJBYJDN@@YGPAEMK@Z
?B_B_P_iiroB@@YGPAKPAD@Z
?k_rHGYI@@YGPAJPAGE@Z
?pp_xajYM_Xj_@@YGMEH@Z
?_kpfDSCXLEqwg__ase__W@@YGXPA_N@Z
?u_bpebH_H@@YGFN@Z
?d_z_w_o_ubfzsm_WZLB_Hv@@YGKPAFPAM@Z
?W_W_CT_EN_VR__@@YGEH@Z
?QSOGVV_Tzuu__ogs@@YGDG@Z
?UKNLEIW_IFkpgik_jzorjq@@YGPAHM@Z
?_LFOLJ___@@YGXPADG@Z
?g_cpsb__hbcyzysws@@YGPA_NG@Z
?n_amuofaUDOC@@YGMPAEE@Z
?HAoqahc_I_p_vvKXNNZ_t@@YGHF@Z
?wmwueou@@YGFPADI@Z
?RQ_m__SVUEQIMcrS_UP_@@YGFF@Z
?lie__tWiW__HMofxe__DJ@@YGXPAEPAG@Z
?b_c__fjjjnvJYjqBQY@@YGKPAF@Z
?hIJEMVo_wddPLDt_whcv_l@@YGPAXH@Z
?ctwwjmqH_RI_M@@YGPAIPAEPAM@Z
?VUX__olbjrrfvg@@YGDPAK@Z
?rlczr_IVLY@@YGMPAHPAF@Z
?O_MWKRs_am@@YGXJ@Z
?ASyMChb_kXOGMLouj_mEQR@@YGGHK@Z
?p_kQD_CVOG_S_@@YGIJK@Z
?wnfi_K_EUgaMY@@YGEGF@Z
?R_Znf_tarem_r_srul_rY_@@YGPANHN@Z
?c__re_kz_vp_vtoVUJZj@@YGXD@Z
?_hdtwww@@YGEPAE@Z
?_iotnkO_TI_xhmo_sckaf@@YGFPAI@Z
?uKakjl_fmqw_j@@YGDPAK@Z
?_ox_tzlwc_jm@@YGXKE@Z
?_ap_y_r@@YGPA_NMM@Z
?ukj_oylt_v__@@YGPAHD@Z
?BMW_QUTVZLIsE@@YGKEM@Z
?_WZ_CGYnih_xCESrlphZY@@YGPAXJ@Z
?QOQl_fjy_@@YGPAGKPAF@Z
?osduyfvXVI@@YGEPAHPAM@Z
?VH_AG_Xttgntms_ipik_@@YGPAXPADJ@Z
?h_motd_lyNT_U__@@YGPAXJ@Z
?ltil_WV_WAr_oxjtshg@@YGFPAGH@Z
?WGXCkx_P__XNXOWV_Pn@@YGFE@Z
?XW_jpiebUJKXRIIH@@YGGI@Z
?_hccuodi_aLY_YOG@@YGDM@Z
?GNhLM_C__@@YGPAKM@Z
?_izzbvgf@@YGDHPAH@Z
?t_mbtVw_@@YG_NKF@Z
?IOKBXz_oh_FZ_XECA_R@@YGXPAJD@Z
?du_e_Q_TOPFm_o__uy@@YGPAJPAM@Z
?_neq__qa_v_L_NX@@YGPADPAEK@Z
?__jlznVS__K__V@@YGPAFPAJ@Z
?r______chkbk@@YGPAXJ@Z
?E__Q_IUK_SCX_Sbdb@@YGGKM@Z
?MX_JONm@@YGMD@Z
?ckru_tlnyxz_pl@@YG_NIPAM@Z
?PONCAFXC@@YGKE@Z
?FumtRsoaj__w@@YGPAJ_N@Z
?_TPYmr__mz_jDWRRP@@YGNGPAH@Z
?rquaQDXCOYNWDMQB@@YGPAGFPAK@Z
?CfnsrlmuY_BFmm_s_qdRM@@YGXG@Z
?V_ZTO_P_MYahka@@YGDI@Z
?lao__IDOXOr_w_x@@YGMFPAF@Z
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ldata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 41KB - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 487B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ