N:\vFSyvvKbSpiHlp\BtwXtXxad\CeoeCfw\mTpnhnVAo.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5c74f7501dbdfa0bf8af885abbcd4cf1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5c74f7501dbdfa0bf8af885abbcd4cf1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5c74f7501dbdfa0bf8af885abbcd4cf1_JaffaCakes118
-
Size
161KB
-
MD5
5c74f7501dbdfa0bf8af885abbcd4cf1
-
SHA1
6acfb0c2a7488a8fc5903784b25add6be289f4e3
-
SHA256
a2f20f511548ae3f659fa5f047bd16459f26cdf65bd29767caf855eea5d923cc
-
SHA512
7d3466d7e9f22a92317c18c0e14e90cbcc1b49e6fd4eae805ab1b3de4444f21acba48bed87e65ee352c973d9319a45d005182f618931e897f7d80a2eafa09552
-
SSDEEP
3072:i5z/2rbd9TDWmo347HZVzDC9iIq8tVeBx8VKAbeW62:i5z/Wbd9bo347ZVnuq8t8SV1beW6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c74f7501dbdfa0bf8af885abbcd4cf1_JaffaCakes118
Files
-
5c74f7501dbdfa0bf8af885abbcd4cf1_JaffaCakes118.exe windows:5 windows x86 arch:x86
19df8dbdd55186cc55e3c48350f2f4c8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
comdlg32
GetSaveFileNameA
ReplaceTextW
PrintDlgW
GetOpenFileNameW
PageSetupDlgW
comctl32
CreateStatusWindowW
DestroyPropertySheetPage
ImageList_GetIcon
ImageList_Draw
user32
CopyRect
CharUpperBuffW
ShowOwnedPopups
GetWindowRect
CopyAcceleratorTableW
ShowCursor
FrameRect
IsCharAlphaNumericW
LoadBitmapA
BeginDeferWindowPos
DialogBoxIndirectParamW
CharToOemBuffA
GetMenuItemInfoW
SendMessageTimeoutW
WaitMessage
LoadIconW
AttachThreadInput
GetForegroundWindow
GetDlgItemInt
MoveWindow
SendMessageA
MonitorFromPoint
DeferWindowPos
MapDialogRect
OpenDesktopW
mouse_event
SendMessageW
ToUnicodeEx
shlwapi
UrlGetPartW
PathMatchSpecA
gdi32
EndPath
ScaleViewportExtEx
CreateSolidBrush
ResizePalette
SetTextColor
BeginPath
SetBkColor
SaveDC
CreatePolygonRgn
CreateBitmap
SelectClipRgn
PathToRegion
CreateFontIndirectW
ntdll
memset
strcspn
msvcrt
exit
kernel32
SetThreadContext
GetSystemDirectoryW
GetLastError
DuplicateHandle
CompareStringW
lstrlenW
LocalFree
TlsFree
lstrcmpiW
lstrcpyA
SetHandleInformation
SuspendThread
ResetEvent
GlobalFree
SetEvent
ReleaseSemaphore
GlobalReAlloc
EnumResourceNamesA
Exports
Exports
?ltWOUH_S__VE__NildVO@@YGMMPAF@Z
?FqL_MWKXm__qoraj_e_@@YGGMM@Z
?e_odsgHQXMTq__EKRJmd@@YGX_N@Z
?gebaeyet_idneeirra_r@@YGEPAKE@Z
?regj_TB__BY_T_EHNXi_cV@@YGPAEKK@Z
?_jdonHDSHJZ_I@@YGFK@Z
?qs_cxwZZN@@YGJI_N@Z
?GbgpycS_bh____r@@YGPA_NK@Z
?Q_O_B_dji_v_KFGplxS@@YGPAXE@Z
?D_Z_qc__kd_r@@YGMPAN@Z
?FqkxoQYVFST__HM_@@YGPA_ND@Z
?_Rrqx_DOT_IlmoAR@@YGPAXDM@Z
?GCONBbg@@YGXEPAK@Z
?a_ksv_drtw_MDT@@YGFPANPAE@Z
?R_PDRXUIA_je_pYH@@YGPANE@Z
?TbWRVTCohlFT@@YGXEF@Z
?OMU_Qtpb__JEKsqLQUGEO_@@YGPAGEK@Z
?Gao_t_eldOGI@@YGGEG@Z
?msQZ_Ap_gzglmfvDTE_e@@YGXKPAM@Z
?YRZAAw_m_DWSZOlux@@YGPAJJPAH@Z
?_ctbPB_HLPEG@@YGXH@Z
?_PKRCTERyfsbGVLF@@YGPA_NPAGD@Z
?EFkwaIMLL_@@YGPA_NPA_N@Z
?_brna_xz@@YGEPADD@Z
?i__zlnMOjpcqsva__jSO@@YGXNPAI@Z
?WMYB_YBW_@@YGFPAEPAG@Z
?qIF_UqPI@@YGDD@Z
?dpzqbdn_G_QTSQUT__LSL@@YGDG@Z
?QZYC_nUYHT_____g@@YGNPAF@Z
?lgewBISV__R@@YGPAHID@Z
?DRBMlqq_bxcbaCTggo_@@YGIPADD@Z
?sqDBNRSAZ_EEV_CR@@YGXPAI@Z
?_shpF_hhqtXUQ__Ep_jj@@YGPA_NPAF@Z
?oJLF_XSMEJ__PGSF@@YGPAFPAK@Z
?WYHPHXJACCL__v__ik_zX@@YGDPAK@Z
?_F__Y_RZX_HOI_O_bf@@YGGK@Z
?lk_ceryfq@@YGXF@Z
?nnho_tr_nzv_doux_v@@YGPAEPAEJ@Z
?_P_R_GZT@@YGXM@Z
?_lrub_bvkMLIKII_JwzryR@@YGPAH_N@Z
?GXXjyojwvURJ_SMjqacb@@YGPAJNPAM@Z
?C_C_MT_purINLZafacu_jS@@YGMEPAJ@Z
?v__q__sh_edPK@@YGXM@Z
?ez_pkqvs_@@YGPAHE@Z
?_Lpr_viw_kmnb_s_@@YGMJ@Z
?czr_zHLD@@YGPAXPAE@Z
?elx_kmYYPCK_SNOR@@YGHPAEE@Z
?UVLAsat_b__mktKRIoguxu@@YGPAIPAG@Z
?__s_yTQFWVwxjINHNuLIAO@@YGJI_N@Z
?_CYGqdV__Uzoyaanc_a@@YGNPAK@Z
?pp_dpLzp__plDiY__MQsy@@YGGNPAM@Z
?____OR__SLUB@@YGPAFD@Z
?VM_PH_UBz_k@@YGXF@Z
?ABB__OQ_Qkj@@YGHPADPAD@Z
?CZY_XV_QzFDGBJ_@@YGGK@Z
?urgek_hdb_zc@@YGPAGPAEF@Z
?KJSQShuflh_a@@YGEFI@Z
?az__er_hprxr__@@YGXNPAI@Z
?SFblrbGBSZEXZBL_@@YGGG@Z
?NUFwcsl_r@@YGPA_NKI@Z
?APZA_z_d_vC__NM@@YGPAGH@Z
?FOz_DNO_Gz@@YGPAEJ@Z
?j_hUCM_____nyepB__XSG@@YGPAXPAN@Z
?BMCGqg_yU__@@YGJPAI@Z
?ILqpgawzt_wXRAMOxp@@YGPA_NI@Z
?tq__lpjga_e@@YGPAIM@Z
?f_n_N_FYB@@YGFD@Z
?lnb_b__h_mmMU_FW@@YGPAIM@Z
?sdbxnp_bdhurtFUBuasmp@@YGXPAJG@Z
?_thfdnXVF@@YGXFH@Z
?R_GTA_VvVLBTQXV@@YGHPAID@Z
?NOIPK__VL@@YGPAXM@Z
?_cx_fnupo@@YGPAIGN@Z
?_wjafXE__DNDM_D_QVD__@@YGHH@Z
?_FJ_Gmo_nzhjrnj_ir@@YGGN@Z
?GYJ_JZMDd_@@YGMJPAM@Z
?cA__KBYKQ_RXQ___Va@@YGHHE@Z
?NOTtG_PMCNU__WRH@@YGNI@Z
?_zf_qegQ_X__KU_LGC_X@@YGPAXGF@Z
?y_qzOTMZvk@@YGXIPAE@Z
?ADHN_QQSV__J@@YGDPAMPAN@Z
?_mi_dligrwf_vvfCKrbl@@YGHM@Z
?VIfxhcd@@YGNFPAH@Z
?O_Wuqfh_uMF_AS__LU_@@YGMDD@Z
?_Q__C__AF_XULWl_c@@YGPAXM@Z
?___wm_oqIQ__ITmnc_lo@@YGPAEH@Z
?SsyoY_Boegn__sdhLX__@@YG_NPAG@Z
?mity_ztMYC@@YGPAJJ@Z
Sections
.text Size: 89KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ldata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 38KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 539B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ