c:\Projects\dxrip1.3.2\ripdump\Release\ripdump.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5aafa703d695c872fb3f611c2342b514_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5aafa703d695c872fb3f611c2342b514_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5aafa703d695c872fb3f611c2342b514_JaffaCakes118
-
Size
48KB
-
MD5
5aafa703d695c872fb3f611c2342b514
-
SHA1
fe7b8a428a58467a330d4aea0d2745941e800e1b
-
SHA256
2254a4112f4df361c9c913abc5ed30df33ecb13cbf38f3f8cb60b36c1a732046
-
SHA512
e28184a5fb06d1b5bfba139d9b4192659711461ef8182f4897f5d3d77405cc60b453f9016058ac158c6d5150d31cecb485e1d1356b04c21d1b210e9f6d6044bb
-
SSDEEP
768:V+E8PGPyWHWWyL3u8Pe6BwUPvoPFaBnSjZXmSqRi3ueDe:V+E8Pc2bzDPbygSW6ZSRUD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5aafa703d695c872fb3f611c2342b514_JaffaCakes118
Files
-
5aafa703d695c872fb3f611c2342b514_JaffaCakes118.exe windows:4 windows x86 arch:x86
b561d994331269dd7dd9cc4ed268ba79
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
MessageBoxA
kernel32
WideCharToMultiByte
GetNumberOfConsoleInputEvents
HeapAlloc
ExitProcess
GetModuleHandleA
GetCommandLineA
GetVersionExA
HeapFree
GetLastError
CloseHandle
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ReadFile
GetProcAddress
TerminateProcess
GetCurrentProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
FlushFileBuffers
SetFilePointer
CreateFileA
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
SetEndOfFile
HeapSize
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
GetLocaleInfoA
VirtualProtect
GetSystemInfo
PeekConsoleInputA
Sections
.text Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE