g:\NewDownLoader\NewDownLoader\Release\NewDownLoader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5ca43f4cb5a53218d82b18078e22e6f8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5ca43f4cb5a53218d82b18078e22e6f8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5ca43f4cb5a53218d82b18078e22e6f8_JaffaCakes118
-
Size
80KB
-
MD5
5ca43f4cb5a53218d82b18078e22e6f8
-
SHA1
d825a282f2714c701f73a8258544b9553a7cffab
-
SHA256
29d72c6499a61ffc52618326bd9546ddd7eaebc65478a6aee777a2caa9b2aade
-
SHA512
846389b1ea5b9d1d7b44b888f4fac4779848d956d4c3b82d5837ce390c24b7323e65d9b1cddc12df59383449aed41e67a0c6eae1d2acb6513ececdbd6851b17c
-
SSDEEP
768:RsGnIbn2sl8vlQ+TeCHwJfXiqOeig37z0iUXMHjjikYRc9wLKvEyemNsVwbIee3K:CT0WLHGeigLz3UcHHR0KMLb2MEGtY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ca43f4cb5a53218d82b18078e22e6f8_JaffaCakes118
Files
-
5ca43f4cb5a53218d82b18078e22e6f8_JaffaCakes118.exe windows:4 windows x86 arch:x86
d93ee721e898bb3598d27484016f3419
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
OpenProcess
Process32FirstW
GetSystemDirectoryW
LoadLibraryW
FreeLibrary
Sleep
CopyFileW
Process32NextW
ExitProcess
CreateToolhelp32Snapshot
GetModuleFileNameW
CloseHandle
GetWindowsDirectoryW
CreateFileW
DeleteFileW
GetCurrentProcessId
GetSystemTime
GetTempPathW
CreateThread
WriteFile
GetProcAddress
SetFilePointer
CreateFileA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
GetLastError
HeapFree
HeapAlloc
MultiByteToWideChar
GetCommandLineA
GetVersionExA
GetProcessHeap
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleA
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSection
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
HeapSize
WriteConsoleA
user32
wsprintfW
psapi
GetModuleFileNameExW
shlwapi
PathFindFileNameW
Sections
.text Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ