D:\programs\out\HLSys\LMInstall\Release\LMInstall.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6ab03559966f6e48b5cfa348d7c05e37_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6ab03559966f6e48b5cfa348d7c05e37_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6ab03559966f6e48b5cfa348d7c05e37_JaffaCakes118
-
Size
343KB
-
MD5
6ab03559966f6e48b5cfa348d7c05e37
-
SHA1
86b8253fb539c89354ac3126089f10e06abbea17
-
SHA256
13f75ae5809097445971ba4870534beaebfc70243c68bdfc5df66cf060a36afe
-
SHA512
4cd14d44b87b9b245540c8b053060b4bf16fc4a35cec87286bbc758d67e70c653fe123658780d80ed0657e2b938c3dda1afce74266d6606a53bd96f4106496bc
-
SSDEEP
3072:CU21GIWn/k0fFxbK4TBftdQI5VVYedrM//8cLAaYedrM//8cLAy:jcHWns0txbK4TBlfGMM/sMM/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6ab03559966f6e48b5cfa348d7c05e37_JaffaCakes118
Files
-
6ab03559966f6e48b5cfa348d7c05e37_JaffaCakes118.exe windows:5 windows x86 arch:x86
be36568b71fed7326355bde6e4346cd9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
setupapi
SetupOpenInfFileA
SetupSetDirectoryIdA
SetupFindFirstLineA
SetupGetStringFieldA
SetupOpenFileQueue
SetupInitDefaultQueueCallback
SetupInstallFilesFromInfSectionA
SetupCommitFileQueueA
SetupDefaultQueueCallbackA
SetupInstallFromInfSectionA
SetupInstallServicesFromInfSectionA
SetupTermDefaultQueueCallback
SetupCloseFileQueue
SetupCloseInfFile
shell32
ShellExecuteA
user32
TranslateMessage
DialogBoxParamW
DispatchMessageA
LoadCursorA
LoadIconA
RegisterClassExA
CreateWindowExA
ShowWindow
UpdateWindow
GetDesktopWindow
DialogBoxParamA
DestroyWindow
DefWindowProcA
BeginPaint
EndPaint
PostQuitMessage
EndDialog
GetMessageA
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
StartServiceA
QueryServiceStatus
OpenServiceA
CloseServiceHandle
OpenSCManagerA
kernel32
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InitializeCriticalSectionAndSpinCount
HeapReAlloc
VirtualAlloc
GetLocaleInfoA
QueryPerformanceCounter
VirtualFree
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
ReadFile
MultiByteToWideChar
ReadProcessMemory
WriteProcessMemory
GetModuleHandleA
GetProcAddress
FindFirstFileA
FindClose
GetLastError
Sleep
LoadLibraryA
DeleteFileA
FindNextFileA
SetLastError
CreateFileA
WriteFile
FlushFileBuffers
CloseHandle
CreateDirectoryA
GetFileAttributesA
RemoveDirectoryA
GetCurrentProcess
VirtualProtect
FindResourceA
SizeofResource
LoadResource
LockResource
FreeResource
GetModuleFileNameA
SetFilePointer
GetSystemDirectoryA
OpenProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetTickCount
LeaveCriticalSection
EnterCriticalSection
CreateMutexA
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetTempPathA
GetWindowsDirectoryA
WideCharToMultiByte
GetSystemInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
HeapFree
HeapAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetStdHandle
GetFileType
Sections
.text Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 197KB - Virtual size: 197KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ