U:\yyomkXsQ\OimgGfmrai\xgaxtbcargbNlh\ocwFnRT\hjdzFoejPpkbl.pdb
Static task
static1
Behavioral task
behavioral1
Sample
68f7cdc83e3612d577cb516a270bca1b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
68f7cdc83e3612d577cb516a270bca1b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
68f7cdc83e3612d577cb516a270bca1b_JaffaCakes118
-
Size
51KB
-
MD5
68f7cdc83e3612d577cb516a270bca1b
-
SHA1
656b552ed3ea8b8a0aa3c529f21c97db4e02d1b6
-
SHA256
4acd1258fbd82cd1b6e5cd028fa9929971c3a6de32182745d94f162fd50b51b4
-
SHA512
138177746db10f3f073bac7b9cc15f990953694f91af1102addeb9c21da748d188c329f65e890e33cd0b5a1fe0cffa318614645e109f8386ccc0f0e53e79a893
-
SSDEEP
1536:AulThcWzoqvvqoA11wLR7CPQ4bbeXmqh:ryDmSo8beWy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 68f7cdc83e3612d577cb516a270bca1b_JaffaCakes118
Files
-
68f7cdc83e3612d577cb516a270bca1b_JaffaCakes118.exe windows:5 windows x86 arch:x86
7c4dc2963d8f8ff9e19f559bad1b9194
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
exit
comctl32
ImageList_Read
CreateToolbarEx
ImageList_Remove
kernel32
UnmapViewOfFile
DeleteAtom
CompareStringW
GlobalSize
CreateDirectoryA
GetTempPathA
FormatMessageW
GetModuleHandleA
DeleteFileA
GetFileTime
lstrcatA
lstrlenW
GetBinaryTypeW
Sleep
GetCommState
FindResourceA
lstrcmpiW
shlwapi
UrlGetPartW
PathMatchSpecA
gdi32
GetClipBox
GetObjectA
OffsetRgn
GetNearestPaletteIndex
RectVisible
CreateBitmap
CreateBrushIndirect
CreatePalette
SetDIBitsToDevice
PtInRegion
EndPage
SetTextColor
UnrealizeObject
user32
wsprintfW
TranslateAcceleratorA
GetDlgItemTextW
PostMessageW
SetSysColors
IsIconic
EnumThreadWindows
CallWindowProcW
LoadAcceleratorsA
BeginPaint
ShowWindowAsync
GetKeyState
GetSystemMenu
GetWindow
ClipCursor
SetDlgItemTextA
CopyImage
GetUpdateRgn
SetScrollPos
DragObject
CloseDesktop
SendMessageTimeoutA
RemoveMenu
DrawMenuBar
CharUpperBuffA
SetScrollInfo
CreateAcceleratorTableW
CharLowerA
ntdll
memset
strcspn
Exports
Exports
?dBTHErfgDBrct_cf_wcutO@@YGHJPAM@Z
?_NNM_ZstuDNxbq___@@YGPAIF@Z
?_Abkeov____rpERNrrC_Gt@@YGPAGM@Z
?hxjk_yvnq@@YGXF@Z
?aquyysGE__thqEOUOZ@@YGHPAM@Z
?jonOB_SBGyvtb_@@YGEEPAD@Z
?mpoyl_eijeKBG@@YGPA_NF@Z
?ET_YMLXYY@@YG_NPAIM@Z
?gqufciusEONYSJNUBY@@YGFPAIPAJ@Z
?_JOh_zk@@YGIDJ@Z
?GAXFgto__zO_@@YGHKPAM@Z
?lrdkwchp@@YGPAMG@Z
?_MJVZI_FFCJB_R__@@YGMHPAH@Z
?VOV__HI_XLP@@YGPAXN@Z
?CSAEIMGqsrAHRPB_@@YGDPAI@Z
?vr_fnh__NGTOsnj@@YGFHG@Z
?uyvY_TSTK_Vz_f___z@@YG_NK@Z
?cFE_E_UOd@@YG_NFM@Z
?P_Q_U_CIGN_EFTWZRFK_@@YGEIM@Z
?KBGqcgtj@@YGGPADPAI@Z
?YZA___YTiplTJLN_ECR@@YGPAFJH@Z
?dX_WF_UY_h@@YGMPAN@Z
?PUO_IA_R@@YGXNF@Z
?UKF_Iedao__ECL_MJ@@YGXJI@Z
?HJJ_J_ojzs_kYXImysnhGR@@YGDPAMPAM@Z
?t__mtKDJB_Kf_eyaxsdr@@YGJED@Z
?dwbhSkyHSP_N___@@YGXPAIPAN@Z
?mjl_efLuntUE_@@YGXPAE@Z
?FFJTWlbmzadGCUG@@YGPAEIPAD@Z
?jg__v_rcfl_GtDJMWOSM_i@@YGFPAG@Z
?FQEIJXDx@@YGJPAK@Z
?lz__pn__r@@YGKE@Z
?aakoKryrb@@YGJPAHM@Z
?_XQGERCN@@YGPAXE@Z
?WLIHLOW_BQIQS__DO___@@YGJJ@Z
?VVHEQ_mf__ovICYOAJos_@@YGKIPAE@Z
?A__IHDI_C__@@YGDPAHJ@Z
?u_aq_akjmyb_@@YGPAXPAJ@Z
?P__IZNHLNwr@@YGDN@Z
?YPKXOH_FXjjmur@@YGPAED@Z
?NL_L_X_Uao__ffCGf_@@YGXG@Z
?NYGltzqjBRUih__e_uv@@YGPAGDE@Z
?WAVzmvjv@@YGFIK@Z
?B_EZRJ_@@YGPAXPAE@Z
?_DVDFU_ojRZSXj_whbb@@YGPAHKM@Z
?WW_c_dktT_RXntn_wJPz@@YGPAEPAGPAK@Z
?lc_lsljwpa_k@@YG_NPAI@Z
?WWZMPWODzn_e@@YGPADD@Z
?_mmrlJY@@YGPAJD@Z
?X_Wpslz_rwn@@YGPAHPADPAJ@Z
?NN__CJ_JTR@@YGJFPAK@Z
?guxmlqv_yfiG@@YGPAJPAJ@Z
?E_SO_ZXGXVCuqn_vu@@YGPANJK@Z
?_IZNqcYQAUNXVI_YD@@YGIPAK_N@Z
?AI_FElGygY@@YGGJI@Z
?WZTVIJDjl_a__YKFLFY_Gx@@YGPAEF@Z
?_g_uu__EWMVXH_JGHNG_O@@YGPAXKD@Z
?ZV___ZY_YEGBLllc_CGB_Y@@YGPADE@Z
?SGAAXUYW_KICB_K@@YGMKPAG@Z
?k_y_ahrfudxvW@@YGGK@Z
?_X_UN_O_U_h_@@YGXK@Z
?emyv_kucJ_ZFQmZ@@YGHPAGPAE@Z
?y_plFYUoqnu__qbwb_j@@YGKPAKPAD@Z
?_AT_FTXzjbVLPS_QH_B@@YGMPAIPAI@Z
?W__XTY__RqYJCOHWJ@@YGPAKFJ@Z
?sORYFPWJ_AKN_ct_mecOZ@@YGDPAFK@Z
?_H__SIIUS__GBSG@@YGGE@Z
?__rE_WHZCE_MDXkE@@YGMPAFPAD@Z
?yabcl_caCT@@YGKPAIH@Z
?MFATIx_@@YGPA_NHK@Z
?EJS__WZPSSH_ULGuaq_Z@@YGFG@Z
?txfzyidmd_r_G@@YGPA_NFD@Z
?MpdxpNv_cvt@@YGFD@Z
?d___vvHLFTL_f_X_I_nww@@YGHHPAD@Z
?smdc_i_@@YGPANJK@Z
?vd____pdc@@YGPAEG@Z
?VQAU_jrv_J__A_EKBidy@@YGPAJI@Z
?itm___mx@@YGXI@Z
?EDB_C_AtpyBZPATEPQRM@@YGPANN@Z
?SHNrbdyVMO_LJXP_HI@@YGPAEPAM_N@Z
?QP_wLT_I_@@YGPAJPAGPAI@Z
?_mtcd_sKOWBK_AT_YI_C@@YGNJI@Z
?RGFASP__CFveb___Z@@YGDF@Z
?qh__topv_a_la_D@@YGEH@Z
?v___ve_yul_wsYYCKTCC@@YGIPADPAJ@Z
?dBAN_EP_QPZYKeo_c_wm@@YGPAXPAD@Z
?BL_T_TXsobe_zD@@YGPAHK@Z
?WEDD__AWJFO_dgyub@@YGXKI@Z
?_OVNOrb__j@@YGHPAH@Z
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ldata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 507B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ