d:\newqq\AdWin\Release\AdWin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6a5b2773c09c0e379a90f661c3d4196e_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6a5b2773c09c0e379a90f661c3d4196e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6a5b2773c09c0e379a90f661c3d4196e_JaffaCakes118
-
Size
192KB
-
MD5
6a5b2773c09c0e379a90f661c3d4196e
-
SHA1
8a92582b5457ef963b4ac1b14a782c6e1d85d744
-
SHA256
4f232eb941e1a400e3d3a2fd11ca8cbb02b59d3ea9583818444f51e1001ff79c
-
SHA512
da6c953b4c4956e62081eba6b60ef58c2fdd620c15462f9f1641c284a5df95f1f097c7af83f556d16d2d0c2c10a8142a26ff75abbdc4f7ed7950a0a36141e80f
-
SSDEEP
3072:Dk0EZbD+806v8QC/eJjRGv3SGPF5q8v81o6dqAwUzBylPV:A5ZbD+7crRGZmo6dvwUzBe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a5b2773c09c0e379a90f661c3d4196e_JaffaCakes118
Files
-
6a5b2773c09c0e379a90f661c3d4196e_JaffaCakes118.exe windows:4 windows x86 arch:x86
072007c5e31a1ab98531b88fb2ecbfd0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
ReleaseMutex
FindClose
FindFirstFileA
SetFileTime
SystemTimeToFileTime
CreateFileA
GetProcAddress
LoadLibraryA
FreeLibrary
LocalFree
MapViewOfFile
UnmapViewOfFile
ExitProcess
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
MoveFileExA
lstrlenA
VirtualFreeEx
GetExitCodeThread
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetCurrentProcess
InterlockedDecrement
CloseHandle
EnterCriticalSection
LeaveCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
FlushFileBuffers
SetStdHandle
InitializeCriticalSection
IsBadCodePtr
GetOEMCP
GetCPInfo
GetStringTypeW
GetStringTypeA
IsBadWritePtr
GetTimeZoneInformation
InterlockedExchange
CreateMutexA
DeleteFileA
CopyFileA
GetModuleFileNameA
Sleep
GetSystemDirectoryA
GetWindowsDirectoryA
GetTempPathA
GetCurrentThreadId
GetLastError
FormatMessageA
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
FindNextFileA
SetFilePointer
ReadFile
LCMapStringW
LCMapStringA
HeapSize
DeleteCriticalSection
HeapReAlloc
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
VirtualFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
RaiseException
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetSystemTimeAsFileTime
IsBadReadPtr
TerminateProcess
GetFileAttributesA
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
WriteFile
user32
CreateWindowExA
DefWindowProcA
PostQuitMessage
EndPaint
BeginPaint
MessageBoxA
PostThreadMessageA
PostMessageA
TranslateMessage
DispatchMessageA
GetMessageA
UpdateWindow
RegisterClassExA
EnumChildWindows
EnumWindows
GetClassNameA
GetWindowThreadProcessId
SetWindowTextA
SystemParametersInfoA
SetWindowPos
FindWindowA
KillTimer
SetTimer
ShowWindow
advapi32
RegCloseKey
RegEnumKeyA
RegEnumValueA
RegQueryInfoKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
shell32
SHGetFolderPathA
ShellExecuteA
ole32
CoCreateGuid
CoInitializeEx
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
VariantClear
GetErrorInfo
VariantInit
netapi32
Netbios
wininet
HttpQueryInfoA
InternetOpenUrlA
InternetSetOptionA
InternetCloseHandle
InternetOpenA
InternetReadFile
userenv
GetProfilesDirectoryA
urlmon
CreateURLMoniker
Sections
.text Size: 152KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE