pcaui.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5c9292133c83c25b631bc8f3f6aa41d2_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5c9292133c83c25b631bc8f3f6aa41d2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5c9292133c83c25b631bc8f3f6aa41d2_JaffaCakes118
-
Size
42KB
-
MD5
5c9292133c83c25b631bc8f3f6aa41d2
-
SHA1
db454ce021e7ae2c671f60cbce26e2b430c4d66f
-
SHA256
eb87aedfd8ff0e00d26b43116056d9f603e7c8e0ceb9fe16f5dfb86f6a7a5765
-
SHA512
439ba7112e5fa17b26fc5f68c9305a8c4e2873ed3b677757ea63766ba743dcce5e75b7e565ed5c31d19118ef16019458cafd8c65acb1ba71db879d8dd6e0e018
-
SSDEEP
768:FLhGGx6T2SqOy5ND9QHsepmg2z3Nf1X7Yu3mzqtIY9NvrrqY:FHx6CSVyHCMepmgkX7j3mBY9NvreY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c9292133c83c25b631bc8f3f6aa41d2_JaffaCakes118
Files
-
5c9292133c83c25b631bc8f3f6aa41d2_JaffaCakes118.exe windows:6 windows x86 arch:x86
e7b4ac06320ce0185e1551e093d77248
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
TraceMessage
CheckTokenMembership
CreateWellKnownSid
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
kernel32
HeapFree
GetLastError
HeapAlloc
GetProcessHeap
LoadLibraryW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LocalFree
ProcessIdToSessionId
GetCurrentProcessId
HeapSetInformation
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
UnhandledExceptionFilter
Sleep
InterlockedExchange
msvcrt
?terminate@@YAXXZ
_except_handler4_common
_controlfp
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_wcsicmp
_wcsnicmp
_wtoi
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
memset
_wcmdln
apphelp
SdbGetEntryFlags
SdbSetEntryFlags
SdbIsNullGUID
ntdll
RtlGUIDFromString
RtlInitUnicodeString
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mswksta Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE