C:\mmp\source\setup\keywordkr\setup\atlexe\atlexe.cpp1kkr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6208a64b9ae6cbedf6b242d6b5f37d51_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6208a64b9ae6cbedf6b242d6b5f37d51_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6208a64b9ae6cbedf6b242d6b5f37d51_JaffaCakes118
-
Size
125KB
-
MD5
6208a64b9ae6cbedf6b242d6b5f37d51
-
SHA1
f022c8566a92fb5dd594074b9ccf847625ca1f18
-
SHA256
82b870d2ad09b8c3b81581a0f761c65aef518fcfef1d249726d96f1727e077b0
-
SHA512
188f0192ab86eb00de9818d57c79dc8bb40a29b4818411abadac66e493e231414e92d734bae63cf5081bf28d529cd9e9f6eb0bdeea5b4a5ac9a70235121aa7c8
-
SSDEEP
3072:NTFfya8lLwrwNqxZcs6uPgGpGNC8qzlawQ5DT:NheekDmGk8qzBu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6208a64b9ae6cbedf6b242d6b5f37d51_JaffaCakes118
Files
-
6208a64b9ae6cbedf6b242d6b5f37d51_JaffaCakes118.exe windows:5 windows x86 arch:x86
5ee8525aa51fcf9ff15c28e6938ebda6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetFileAttributesExA
ExpandEnvironmentStringsA
lstrcatA
lstrcpyA
GetModuleHandleA
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
SetEvent
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetTickCount
lstrcmpiA
GetLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
CloseHandle
GetFileTime
CreateFileA
GetTempPathA
GetLastError
CreateMutexA
MoveFileA
DeleteFileA
GetCommandLineA
Sleep
LoadLibraryA
CreateThread
GetProcessHeap
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
GetProcAddress
FreeLibrary
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
RaiseException
WideCharToMultiByte
WaitForSingleObject
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
HeapSize
SetFilePointer
GetFileType
SetHandleCount
ReadFile
GetStdHandle
WriteFile
ExitProcess
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
VirtualFree
HeapCreate
GetStartupInfoA
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
HeapReAlloc
HeapAlloc
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
user32
GetMessageA
BringWindowToTop
ShowWindow
FindWindowA
SendMessageTimeoutA
RegisterWindowMessageA
UpdateWindow
CreateWindowExA
PostThreadMessageA
GetSystemMetrics
GetClassNameA
EnumChildWindows
IsWindow
EnumWindows
SetTimer
PostQuitMessage
wsprintfA
MessageBoxA
TranslateMessage
DispatchMessageA
DefWindowProcA
LoadCursorA
RegisterClassExA
MoveWindow
advapi32
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
shell32
ShellExecuteA
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
LoadTypeLi
LoadRegTypeLi
DispCallFunc
SysFreeString
SysAllocString
VariantInit
VariantClear
SysStringLen
shlwapi
PathFileExistsA
PathRemoveBlanksA
PathFindFileNameA
PathGetArgsA
urlmon
URLDownloadToFileA
ws2_32
socket
WSAStartup
htons
gethostbyname
closesocket
ioctlsocket
connect
select
__WSAFDIsSet
send
recv
netapi32
Netbios
Sections
.text Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ