c:\workarea\8.85\drivers\2d\dal\eeu\build\service\w7\B_rel\atiesrxx.pdb
Static task
static1
Behavioral task
behavioral1
Sample
71afa563ff023685e2e2cb8a6c448f3e_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
71afa563ff023685e2e2cb8a6c448f3e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
71afa563ff023685e2e2cb8a6c448f3e_JaffaCakes118
-
Size
172KB
-
MD5
71afa563ff023685e2e2cb8a6c448f3e
-
SHA1
c50fff820d80bf210368ff95c09bdb811a05b310
-
SHA256
8c29a693247c39d69fbcb8f892c40da8f3d041ca2ec3df401dbe8e933b753980
-
SHA512
006165d91d663639e8f2ec21f84fd3fcc642adc5976c3901ba231795cb52211d355039599e06f0a448700966e53e8706a5f9d0abb27faecae6900132871fc98f
-
SSDEEP
3072:nGen5QvCNTHaVZnytc8zLLWefWCh2A/Bq9NaCtssZf/VPj5it5gjx0:J5Q6NT6VZnytcqWefl2Qq9P/VL5iA9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 71afa563ff023685e2e2cb8a6c448f3e_JaffaCakes118
Files
-
71afa563ff023685e2e2cb8a6c448f3e_JaffaCakes118.exe windows:6 windows x86 arch:x86
00a65fd207df25a748eb8d6c6cbddedb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
PostThreadMessageA
SystemParametersInfoA
UnregisterDeviceNotification
PostMessageA
RegisterDeviceNotificationA
advapi32
RegCloseKey
RegQueryValueExA
RegisterEventSourceA
ReportEventA
ImpersonateLoggedOnUser
RevertToSelf
OpenProcessToken
CreateProcessAsUserA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
DeleteService
OpenServiceA
SetServiceStatus
RegisterServiceCtrlHandlerExA
StartServiceCtrlDispatcherA
RegSetValueExA
RegCreateKeyExA
RegSetValueExW
RegDeleteValueA
RegGetValueA
RegOpenKeyExA
RegDeleteKeyA
RegOpenCurrentUser
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
wtsapi32
WTSEnumerateProcessesA
WTSQueryUserToken
WTSFreeMemory
WTSQuerySessionInformationA
psapi
GetModuleBaseNameA
EnumProcessModules
userenv
LoadUserProfileA
UnloadUserProfile
powrprof
PowerGetActiveScheme
PowerSetActiveScheme
PowerWriteACValueIndex
PowerWriteDCValueIndex
PowerEnumerate
PowerSettingAccessCheck
PowerReadACValueIndex
PowerReadDCValueIndex
kernel32
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
CreateFileA
GetProcessHeap
SetEndOfFile
GetTimeZoneInformation
VirtualQuery
GetSystemInfo
VirtualProtect
RaiseException
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetModuleHandleW
InitializeCriticalSection
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
lstrcmpiA
WaitForSingleObject
MapViewOfFile
CreateFileMappingA
OpenProcess
GetLastError
GetModuleFileNameA
WTSGetActiveConsoleSessionId
OutputDebugStringA
GetLocalTime
CloseHandle
Sleep
GetVersionExA
GetSystemDirectoryA
CreateProcessA
CreateMutexA
OpenMutexA
ReleaseMutex
CreateEventA
OpenEventA
WaitForMultipleObjects
SetEvent
ResetEvent
CreateThread
SetThreadPriority
CreateNamedPipeA
ConnectNamedPipe
DisconnectNamedPipe
ReadFile
WriteFile
FlushFileBuffers
LocalFree
GetCommandLineA
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetCurrentThread
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
FatalAppExitA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
SetFilePointer
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
Sections
.text Size: 128KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ