d:\软件\st\Release\startsvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
608a05db131a4a761c26c0ac4b9b0f10_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
608a05db131a4a761c26c0ac4b9b0f10_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
608a05db131a4a761c26c0ac4b9b0f10_JaffaCakes118
-
Size
76KB
-
MD5
608a05db131a4a761c26c0ac4b9b0f10
-
SHA1
2e58f4d73d073f598a2c8af684adbf3ad99342f4
-
SHA256
2cf30ff13250be346b4c3c057af67114918fe31c2f5a8f0f6a19dd37ed094a10
-
SHA512
dd434f8920510e6c17b4fedc67e533c5be39d73840a66f8ddba26aded2bbcc2fc14d9b788c13e2227629343877c900b4c8de28b9caa77ef142e0db5032164c32
-
SSDEEP
1536:pfm5W0losjIrhlLxZ4WFcMtgpWM9zvrJICLuCul:pfm5WYJslT6MtWzvlZql
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 608a05db131a4a761c26c0ac4b9b0f10_JaffaCakes118
Files
-
608a05db131a4a761c26c0ac4b9b0f10_JaffaCakes118.exe windows:4 windows x86 arch:x86
daf43bec75f3c0acdd05a8ae0c94ddd4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
lstrlenA
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
WaitForSingleObject
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
FlushFileBuffers
SetStdHandle
SetFilePointer
GetStringTypeW
GetStringTypeA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
WriteFile
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
LCMapStringW
LCMapStringA
GetCPInfo
GetOEMCP
GetCommandLineA
GetStartupInfoA
GetCurrentProcess
TerminateProcess
GetModuleHandleA
HeapDestroy
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
ExitProcess
ws2_32
WSAResetEvent
WSASend
WSAGetOverlappedResult
WSAConnect
WSAEnumNetworkEvents
WSACloseEvent
WSACleanup
WSARecv
gethostbyaddr
htons
getservbyname
htonl
inet_ntoa
gethostbyname
WSAGetLastError
inet_addr
WSAEventSelect
WSASetEvent
WSACreateEvent
WSAStartup
closesocket
WSASocketA
getservbyport
ntohs
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ