C:\test.pdb
Static task
static1
Behavioral task
behavioral1
Sample
60bd5b125d8252e18305ad06cb5d0844_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
60bd5b125d8252e18305ad06cb5d0844_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
60bd5b125d8252e18305ad06cb5d0844_JaffaCakes118
-
Size
53KB
-
MD5
60bd5b125d8252e18305ad06cb5d0844
-
SHA1
e6c58128e3925573b6b99f4a479d57e445440d2b
-
SHA256
c7121f2d2e9001bf6f53020db89d5e53dfc6b6696b581f45956f5cdfd34bdf67
-
SHA512
bff9feca710bc4dc55df48b399fff021e0b550d7d31f9a1981e31b734b8bb10ddd7d5b2f763173e2a4118b0600d0791a233df3fef691a9f0347cd7f0ad87dbd3
-
SSDEEP
768:zPJLR9AnWlPotIDLqKCoxCBQq1KQMVroIokLI/M5tOtqFcrMEFGWlakWFlr9HyCm:FFQtIDLqGbrowLv8tEQ7nTWF5UCpM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 60bd5b125d8252e18305ad06cb5d0844_JaffaCakes118
Files
-
60bd5b125d8252e18305ad06cb5d0844_JaffaCakes118.exe windows:5 windows x86 arch:x86
43abc11276eed41a032c62348c6ac12b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
??2@YAPAXI@Z
??3@YAXPAX@Z
srand
rand
strtoul
strrchr
strstr
memset
memcpy
_except_handler3
shlwapi
PathFileExistsA
SHDeleteKeyA
SHSetValueA
SHGetValueA
SHDeleteValueA
psapi
GetModuleFileNameExA
kernel32
CreateFileA
SetFilePointer
VirtualFree
WriteFile
ReadFile
GetLastError
VirtualAlloc
DeviceIoControl
CloseHandle
ExitProcess
lstrlenA
VirtualQuery
WaitForSingleObject
GetCommandLineA
OpenProcess
Sleep
CreateEventA
GetSystemDirectoryA
lstrcatA
MultiByteToWideChar
lstrcmpiA
GetProcAddress
CopyFileA
LoadLibraryA
SetNamedPipeHandleState
GetModuleFileNameA
lstrcmpiW
GetModuleHandleA
VirtualProtect
GetVersionExA
GetTempPathA
lstrcpyW
DeleteFileA
lstrcpyA
FindResourceA
FreeResource
SetEndOfFile
FreeLibrary
LoadResource
GetCurrentProcess
Process32First
GetSystemTimeAsFileTime
SizeofResource
GetExitCodeProcess
CreateProcessA
Process32Next
LockResource
CreateToolhelp32Snapshot
LocalFree
SetEvent
ExitThread
lstrlenW
OpenEventA
DuplicateHandle
GetCurrentProcessId
GetSystemTime
CreateThread
GetFileSize
user32
FindWindowA
PostMessageA
MessageBoxA
SendMessageA
wsprintfW
wsprintfA
advapi32
RegQueryValueExA
CloseServiceHandle
OpenServiceA
CreateServiceA
StartServiceA
QueryServiceStatus
OpenSCManagerA
ControlService
RegOpenKeyA
RegCloseKey
GetNamedSecurityInfoA
AdjustTokenPrivileges
BuildExplicitAccessWithNameA
LookupPrivilegeValueA
SetNamedSecurityInfoA
SetEntriesInAclA
OpenProcessToken
shell32
ShellExecuteA
Exports
Exports
CoCreateInstance
CoGetMalloc
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
GradientFill
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ