K:\lZslMwgcfpmzq\qBZgvnYea\sZlyuOT.pdb
Static task
static1
Behavioral task
behavioral1
Sample
62382be2e2cc8af6dc09c95279d620d2_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
62382be2e2cc8af6dc09c95279d620d2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
62382be2e2cc8af6dc09c95279d620d2_JaffaCakes118
-
Size
168KB
-
MD5
62382be2e2cc8af6dc09c95279d620d2
-
SHA1
9ae935f49ceb8c0c3757dc097506c909fece5eac
-
SHA256
1a44be12c8092a57f446a6d007967f27a96cecbfbb88cbdaa059368e375c5767
-
SHA512
ead307c69aecac6ae07bbb21dfae781bc72d9672b612fc4e896d607a72e14074995f0bffcf6dfff6ce111739685c909031e4c7d0a553baa4e829dab8f9cb3f0f
-
SSDEEP
3072:V2O5tCdFhi79UF2UB+CH384McsfJ68qlwrawla9bMCMkU/ske3m:f5UqmB+CHBCfJNqulOIClU6m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 62382be2e2cc8af6dc09c95279d620d2_JaffaCakes118
Files
-
62382be2e2cc8af6dc09c95279d620d2_JaffaCakes118.exe windows:5 windows x86 arch:x86
3ae07eb1d30f6fd841927a1f7afc7539
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
DrawTextA
GetSubMenu
MapVirtualKeyW
MessageBoxExW
CharToOemW
DestroyCaret
DestroyMenu
CharPrevA
GetUpdateRgn
DispatchMessageA
IsRectEmpty
ScrollWindow
SetLastErrorEx
LoadAcceleratorsW
FillRect
SetActiveWindow
EnableScrollBar
DragObject
GetMonitorInfoW
SetUserObjectInformationW
CharLowerBuffW
FindWindowExA
MapVirtualKeyA
ToUnicodeEx
CreateDialogParamW
IsZoomed
DrawTextExW
DrawEdge
LockWindowUpdate
RemoveMenu
GetDlgCtrlID
SetRect
SendMessageTimeoutA
GetScrollPos
ChildWindowFromPointEx
CopyAcceleratorTableW
GetWindowTextLengthW
GetWindowLongA
GetClassLongW
SetTimer
GetClassInfoExA
KillTimer
GetMenuStringA
LoadIconA
msvcrt
_controlfp
setvbuf
__set_app_type
fgetc
__p__fmode
__p__commode
isalpha
_amsg_exit
_initterm
_acmdln
gets
exit
_ismbblead
_XcptFilter
strncmp
atoi
_exit
_cexit
vswprintf
__setusermatherr
__getmainargs
realloc
srand
strtok
fwrite
wcstod
kernel32
FileTimeToLocalFileTime
ReleaseMutex
GetAtomNameW
GetFileSize
lstrcpyA
SetThreadExecutionState
ExitProcess
GetThreadTimes
GetModuleFileNameW
GlobalHandle
GetCommandLineW
TryEnterCriticalSection
SetThreadContext
CreateNamedPipeA
GlobalCompact
GetCommandLineA
GetTempPathA
LocalReAlloc
ReleaseSemaphore
CreateThread
ExitThread
AddAtomA
comdlg32
ChooseFontW
GetSaveFileNameA
shlwapi
StrToIntW
IntlStrEqWorkerA
PathRemoveBlanksW
ChrCmpIA
StrToInt64ExA
gdi32
CreateDIBSection
Rectangle
CreateDiscardableBitmap
PathToRegion
SetROP2
GetTextExtentPointW
GetPaletteEntries
SetPaletteEntries
ExcludeClipRect
SetRectRgn
SetBkColor
SetDIBColorTable
SetBitmapBits
CreatePatternBrush
CreatePolygonRgn
RemoveFontResourceW
TextOutW
SetLayout
SetAbortProc
Exports
Exports
?HideStateOld@@YGPAJPAJ&U
?IncrementDirectoryExW@@YGPAMPAMHHI&U
?DeleteListItemExA@@YGMPANF&U
?AddWindowInfoExA@@YGGPA_NJG&U
?IsNotPenExW@@YGPADJ&U
?CopyTimeOld@@YGED&U
?IsConfig@@YGJPAJHPANPAF&U
?IsValidPointEx@@YGXIPAFM&U
?RtlWidthEx@@YGHNFDK&U
?InsertPointOriginal@@YGEG&U
?DeleteFolderPathOriginal@@YGXJKD&U
?IsValidProfileExA@@YGPAJG&U
?LoadAppNameOld@@YGIPAHDPAJPAE&U
?InsertMainStructDlhSi@@YGKGH@Z
?LoadPathExA@@YGMGHPA_NPA_N&U
?IsNotSemaphoreExW@@YGPAGPA_NPAK&U
?ModifyVersionExA@@YGKJPAM&U
?InstallDeviceEx@@YGPAFHHPAIPAF&U
?DecrementComponentA@@YGPAXH&U
?InsertClassExA@@YGJFPAHDPAH&U
?ValidateWindowInfoExA@@YGXK&U
?CallModuleA@@YGPA_NHM&U
?AddFilePathA@@YGPAIPAIDPAH&U
?CallMessageA@@YGPAJMFHH&U
?FormatFolderPath@@YGPAKJIE&U
?RemoveDate@@YGK_NGI&U
?CallDateA@@YGMPAEJM&U
?GlobalSystemOld@@YGIPAN&U
?LoadTimerExW@@YGMJEHK&U
?GenerateText@@YGFNM&U
?GenerateNameExW@@YGFNPAJ&U
?InstallKeyNameOld@@YGPAENPAM&U
?GlobalSectionExA@@YGXPAKE&U
?FindSystem@@YGXHK&U
?IsAppNameA@@YGXPANGJ&U
?OnPenA@@YGPAFJPAJ&U
?ShowTimeExA@@YGGDFF&U
?OnNameEx@@YGJDPAI&U
?SetOptionOriginal@@YGHPAE_N&U
?CloseComponent@@YGMPANEPAM&U
?RtlDateTime@@YGXDG&U
?SendConfigExW@@YGPAKI&U
?ShowMediaTypeOld@@YGPAJDHJ&U
?ValidateArgumentExW@@YGMJPAKPAJI&U
?RtlWindowW@@YG_NPAMJD&U
?OnDeviceA@@YGPADPAMNPAG&U
?InstallProcessEx@@YGGMI&U
?RemoveHeaderOriginal@@YGPAKM&U
?SendSemaphoreW@@YGJPAE&U
?InstallProjectOld@@YGXKPAHFM&U
?SendAnchorA@@YGFPADGEH&U
?RemoveScreenNew@@YGPAJPAF&U
?ValidateSemaphoreOriginal@@YGJPAH&U
?SendSizeA@@YGEHG_N&U
?EnumWidthW@@YGXI&U
?CallProviderNew@@YGKHPAFN&U
?SendPenW@@YGEPAHPAFMI&U
?EnumKeyboard@@YGPADM&U
?FindVersionOld@@YGPADIPAF&U
?DecrementArgumentOriginal@@YGXE&U
?DeleteSystemEx@@YGNPAJ&U
?FreeMutexEx@@YGPADH&U
?IncrementFileOriginal@@YGFPAH_NDPA_N&U
?SetAnchorW@@YGXGPAGPAI&U
?PutObjectW@@YGEIPAK&U
?CrtDirectoryW@@YGKFPANG&U
?StateW@@YGMEG&U
?CloseNameOriginal@@YGXIF&U
?GenerateKeyboardA@@YGIPAFF&U
?ShowDialogA@@YGPAJPA_NDG&U
?FreeComponentEx@@YGDPAI&U
?CopyFolderW@@YGPAMHIGPAM&U
?CancelMonitorW@@YGPANK&U
?CallClassOld@@YGDPAE&U
?SetPointOld@@YGJID&U
?InstallMonitorEx@@YGPAXPAIPADMJ&U
?AddKeyboardEx@@YGXEPAINPAF&U
?EnumProjectExA@@YGNJPAJ&U
?ValidateThreadOriginal@@YGPAIPAN_NH&U
?IncrementMemoryNew@@YGXPAHDG&U
?ModifyWindowInfoA@@YGJIMPADG&U
?CancelFunctionW@@YGJI&U
?FreeFileExA@@YGPAGFEJK&U
?OnDateTimeExW@@YGEIK&U
?PutCommandLineEx@@YGEI&U
?PutKeyName@@YGFGGG&U
?DecrementWidthOriginal@@YGXFPAI&U
?ShowWidthOriginal@@YGPADPAFPAJPAG&U
?OnDialogW@@YGGPAH&U
?HideListEx@@YGGE&U
?OnTaskA@@YGXGI&U
?ModifyTaskOld@@YGPADEIPAMPAJ&U
?FindAppNameExA@@YGPAMKPA_N&U
?AddProcess@@YGXJE&U
?OnMediaTypeA@@YGPAXMPAFFPAJ&U
?CloseFullName@@YGPANPAM&U
?AddDateTimeA@@YGPAHGPAH&U
?CopyDialogOld@@YGIJPAHE&U
?KillStringW@@YGPAEDPAHHPAE&U
?IsValidConfigOriginal@@YGJNGPAHF&U
?InstallProjectEx@@YGEPAJ&U
?HideExpressionOriginal@@YGHJPAJH&U
?DecrementMemoryOld@@YGMNPAMPAJF&U
?LoadFilePath@@YGKPAMGPAG&U
?RtlAppNameOriginal@@YGDPAKMPAF&U
?InsertListItemOld@@YGPAEPAGPAED&U
?FindFunctionExA@@YGPAEGG&U
?ShowFullNameExW@@YGJPAKHMPAN&U
?EnumMessageNew@@YGKKDJPAD&U
?FreeWindowA@@YGMG&U
?GlobalListOriginal@@YGEI&U
?InsertWindowInfoOld@@YGJPAF_NPAKPA_N&U
?OnMonitorEx@@YGHED&U
?DecrementProviderExA@@YGPAX_N&U
?InsertDateOriginal@@YGXPAEPAE&U
?CancelDirectoryOld@@YGIPAFPAFJ&U
?RtlTimerNew@@YGKMPAHPADI&U
?CallOptionExW@@YGPAGKDPAF&U
?IsNotExpressionNew@@YGMJEN&U
?ModifyPathEx@@YGPADNDPAK&U
?FormatCharA@@YGI_NPAGM&U
?SetWindowInfoOriginal@@YGFFEPAE&U
?RemovePathExA@@YGPAHFKJPAH&U
?CrtAnchorA@@YGFKPAJGJ&U
?ValidateMessageEx@@YGPAKPAIDPAM&U
?IsNotWindow@@YGPAXPAD&U
?CloseMemoryOld@@YGPANE&U
?LoadMessageEx@@YGPAMPAHPAED&U
?InsertMutantExW@@YGPAXPAIKEI&U
?InsertDevice@@YGXPAJ&U
?IncrementMutexEx@@YGXMDGG&U
?FormatProfileNew@@YGN_N&U
?SetClass@@YGPADPAEJK&U
?RtlVersionExW@@YGFPAGPAF&U
?ShowStateExW@@YGXKPAE&U
?IsListItemExA@@YGPAEJPA_NPAH&U
?GlobalVersionEx@@YGPAXFJI&U
?CommandLineExW@@YGPAIPADD&U
?SetAppNameOriginal@@YGHMGD&U
?HidePenExW@@YGXIDPAGF&U
?LoadDataExW@@YGKM&U
?DecrementFunctionW@@YGPAKFIHPAN&U
?RtlCommandLineNew@@YGHKPAKE&U
?HideListItemExA@@YGKEJJ&U
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rimp Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.redt Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdbg1 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rit Size: 1024B - Virtual size: 528B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdbg2 Size: 512B - Virtual size: 63B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rvar Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rpt Size: 512B - Virtual size: 452B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hdata Size: 1024B - Virtual size: 720B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ping Size: - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ