c:\winnt\ntos.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5eff66ae2e49a98b091b4e1bf029f89e_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
5eff66ae2e49a98b091b4e1bf029f89e_JaffaCakes118
-
Size
216KB
-
MD5
5eff66ae2e49a98b091b4e1bf029f89e
-
SHA1
4f3fe2da1718cc2d55b1afdaa807d76c8e104f09
-
SHA256
2824efd56ac2c2e7f551510bf30e5fade4f572648b9bef7e7824e29e91ac6808
-
SHA512
1f45dcbc81ca0b1c3d45ba1deeb620b84ea08103e74895939c67f2cf6ad87cd00a470b569674692a9a0e8bc089f26629457449af85ab2f012316203ceeb73724
-
SSDEEP
3072:qZKsVDbJ5D8G5KulGGdBpetUky1KnguG:qQCJ5D8kGGdBwSt1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5eff66ae2e49a98b091b4e1bf029f89e_JaffaCakes118
Files
-
5eff66ae2e49a98b091b4e1bf029f89e_JaffaCakes118.exe windows:4 windows x86 arch:x86
b9675414f6439b025f9488cd8d8050ec
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Sleep
VirtualFree
VirtualAlloc
LoadLibraryA
VirtualProtect
GetProcAddress
GetModuleHandleA
GlobalLock
TerminateThread
CloseHandle
FlushFileBuffers
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
HeapSize
FindFirstFileA
VirtualLock
RaiseException
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
VirtualQuery
InterlockedExchange
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitProcess
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
HeapFree
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
HeapReAlloc
RtlUnwind
GetSystemInfo
user32
EnumWindows
IsWindowVisible
PostMessageA
DestroyWindow
GetDesktopWindow
EnableWindow
gdi32
SetPixel
shell32
ShellAboutA
psapi
GetProcessMemoryInfo
GetWsChanges
winmm
waveInPrepareHeader
waveOutGetDevCapsA
Sections
.text Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ