ftp.pdb
Behavioral task
behavioral1
Sample
6015c64163ae365a34b3543d038eae24_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6015c64163ae365a34b3543d038eae24_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6015c64163ae365a34b3543d038eae24_JaffaCakes118
-
Size
153KB
-
MD5
6015c64163ae365a34b3543d038eae24
-
SHA1
67078875ac5e9194f039d0453ac4c3a323f0ab10
-
SHA256
d1a65fc118e1fb9066aa1c41fd1f8800e8a1dcabb1c316a12b046457629a81ac
-
SHA512
1bc246fc7aa18808bdf99a7a0908dd6c6a748895b1a2487680f753e35c3ddf6b69f66734caf331c761f3ec51c48a596bd7d089d7660405bf8be7eabe463fb89a
-
SSDEEP
3072:qd8ePBmXCyK2/RPZuZqbvExgHV8ARgKf9Pqn4/cUD2kmz:E8ePBcuZqZLRgK52xUDQz
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6015c64163ae365a34b3543d038eae24_JaffaCakes118
Files
-
6015c64163ae365a34b3543d038eae24_JaffaCakes118.exe windows:5 windows x86 arch:x86
60be34e383e683f171d6de8956df339c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
sprintf
_write
strchr
_setjmp3
_isatty
clearerr
putchar
longjmp
exit
islower
toupper
_chdrive
isdigit
_errno
_getcwd
tolower
printf
fflush
_mbslen
_mbsnbcnt
_mbsnbcat
fprintf
getenv
_tempnam
tmpnam
vsprintf
vfprintf
_read
clock
_fstat
_fsopen
calloc
_c_exit
_exit
_XcptFilter
_cexit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_chdir
_mbsnbcpy
free
fopen
_unlink
fclose
_mbscmp
_mbscpy
_mbscat
_mbstrlen
_iob
fgets
_mbschr
atoi
advapi32
GetUserNameA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
kernel32
ReadFile
GetConsoleMode
Sleep
WriteFile
SetConsoleMode
GetProcessHeap
HeapFree
FormatMessageA
SetThreadUILanguage
LocalAlloc
LocalFree
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetTempPathA
GetTempFileNameA
WaitForMultipleObjects
MoveFileExA
GetFileSizeEx
CreateFileA
CreateEventA
GetOverlappedResult
InterlockedExchange
InterlockedCompareExchange
HeapAlloc
FindFirstFileA
FindNextFileA
IsDBCSLeadByteEx
GetEnvironmentVariableA
CreateProcessA
WaitForSingleObject
CloseHandle
GetLastError
InitializeCriticalSection
GetCurrentDirectoryA
SetConsoleCtrlHandler
EnterCriticalSection
GetFileAttributesA
LeaveCriticalSection
user32
CharNextExA
CharToOemBuffA
OemToCharBuffA
ws2_32
listen
getnameinfo
ntohs
setsockopt
send
accept
select
__WSAFDIsSet
recv
WSAStartup
getservbyname
socket
htonl
bind
WSAGetLastError
getsockname
connect
shutdown
closesocket
htons
gethostname
getaddrinfo
freeaddrinfo
WSARecv
mswsock
TransmitFile
s_perror
shlwapi
PathIsDirectoryA
PathFileExistsA
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE