S:\qxjaslmjxtg\VeqjtzyaHbxnn\uaevLjkcitJyF.pdb
Static task
static1
Behavioral task
behavioral1
Sample
77c1009c278c18cdcbd8970ffeeff0e4_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
77c1009c278c18cdcbd8970ffeeff0e4_JaffaCakes118.exe
Resource
win10v2004-20240729-en
General
-
Target
77c1009c278c18cdcbd8970ffeeff0e4_JaffaCakes118
-
Size
123KB
-
MD5
77c1009c278c18cdcbd8970ffeeff0e4
-
SHA1
4fd9e5e1040284ef662bea51222b3a1589c2f9ab
-
SHA256
15549c4b30cf33f3a52ef9ca775ba2ae34b4e43b9410d76563d6032b4617a097
-
SHA512
66bc030e1841bb82b8d81e00cbcb191455eff551566240599a0f1a8a8a551428a65284e74d19aea8eb438cac59f06b14f00d59f2fd8aaa605ef5371f64ce3e21
-
SSDEEP
3072:n0vRNNRiJA74mGyuat3d5PDKHFtqRBrMqeReM5:iRSA57uaDlWFtqbMqeRT5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 77c1009c278c18cdcbd8970ffeeff0e4_JaffaCakes118
Files
-
77c1009c278c18cdcbd8970ffeeff0e4_JaffaCakes118.exe windows:5 windows x86 arch:x86
7d2d0e6cb8d73c3b721dfa40d9d1185d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
gdi32
GetTextColor
EnumFontsW
SetPixel
EndPath
ResizePalette
GetCharWidth32W
Escape
ExtFloodFill
WidenPath
SetBitmapDimensionEx
SetPaletteEntries
SelectClipRgn
IntersectClipRect
GetTextMetricsW
ScaleWindowExtEx
RectVisible
GetObjectA
DeleteDC
SetBkColor
user32
WindowFromPoint
CharPrevW
SetLastErrorEx
GetMenu
SendDlgItemMessageW
AdjustWindowRect
GetShellWindow
GetScrollInfo
GetParent
CopyImage
MapDialogRect
SetCaretPos
DestroyCursor
DrawIconEx
GetWindowLongA
LoadIconW
MessageBoxExA
GetScrollRange
RemoveMenu
GetKeyboardLayoutList
CreateIconFromResource
RedrawWindow
DrawStateA
DrawFrameControl
GetSystemMenu
CharUpperA
CreateDialogIndirectParamW
TileWindows
PostThreadMessageW
KillTimer
GetWindow
GetClassInfoA
GetFocus
CharToOemW
SetForegroundWindow
IsChild
SetWindowLongA
FindWindowW
ShowCursor
PostMessageW
ReplyMessage
DeleteMenu
SetWindowTextW
DeferWindowPos
msvcrt
_controlfp
vsprintf
wcstombs
__set_app_type
__p__fmode
wcscoll
srand
fputs
__p__commode
_amsg_exit
rand
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
atoi
wcsstr
_exit
_cexit
gets
__setusermatherr
tolower
__getmainargs
iswdigit
wcsncpy
shlwapi
StrToInt64ExA
ChrCmpIA
PathRemoveBlanksW
comctl32
ImageList_AddMasked
ImageList_ReplaceIcon
CreatePropertySheetPageA
CreatePropertySheetPageW
ImageList_GetIcon
kernel32
GetVersionExA
GetFileType
CreateFileW
FindNextFileW
SetNamedPipeHandleState
EnumResourceNamesA
GetThreadContext
ClearCommBreak
CallNamedPipeW
GetAtomNameW
FileTimeToDosDateTime
AreFileApisANSI
GetModuleHandleA
LoadResource
lstrcpynW
HeapWalk
GlobalFindAtomW
ExitProcess
GetTimeFormatA
GetLocaleInfoW
GetModuleFileNameW
GetCommState
LocalReAlloc
Exports
Exports
?IncrementMessageW@@YGM_NPAE~U
?CancelMonitorExA@@YGGDKMH~U
?CancelObject@@YG_NPAH~U
?ShowStateEx@@YGX_NGI~U
?IncrementProvider@@YGGJJE~U
?AddMonitorExW@@YGDJH~U
?WidthExW@@YGPAXHIPAEPAH~U
?InsertDateTimeOld@@YGPAKKM~U
?RtlExpressionOriginal@@YGPAEDPAJ~U
?ValidateCharOld@@YGFPAJPANM_N~U
?DeleteHeaderA@@YGPAKEK~U
?OnDataW@@YGXPAE~U
?FreeConfigA@@YGXN~U
?DeleteArgumentOriginal@@YGPAED_NPADPAD~U
?FreeTaskEx@@YGME~U
?CloseHeaderNew@@YGDPANEPAFPAJ~U
?FreeDeviceExA@@YGPA_NII~U
?DeletePenOld@@YGPAXPAJKPANN~U
?InsertCharOld@@YGPAEF~U
?IsPenOriginal@@YGPANPADPAI~U
?RtlTimerA@@YGPADIPAD~U
?IsNotCommandLineOriginal@@YGXMDKPAF~U
?OnFolderPathOld@@YGPAFEDK~U
?SetProjectA@@YG_NPAFIPAGD~U
?DecrementPenOld@@YGJD~U
?GlobalDirectoryExA@@YGIE~U
?CloseWindowEx@@YGXFD~U
?CloseClass@@YGJG_N~U
?GlobalMonitorW@@YGXEPAJH~U
?IncrementWindow@@YGF_N~U
?KillHeightOld@@YGFPA_NFFPAF~U
?SetHeaderExW@@YGFD~U
?ValidateFolderPathEx@@YGDEPAIID~U
?EnumPenEx@@YGPA_NMKJ~U
?ValidateCommandLineExA@@YGMPAKHJK~U
?FormatTask@@YGPAXPAHENJ~U
?GetDirectoryNew@@YGPA_NFIPAGN~U
?CopyDateTimeW@@YGDPAKPA_NPAJE~U
?GetWidthEx@@YGXFJ~U
?DeleteFolderA@@YGPAGM~U
?SetFilePath@@YGMPANKPAD~U
?SetListItem@@YGMJ~U
?InsertStateExW@@YGXHPAIPAD~U
?GetSizeOriginal@@YGPADIHPAHPAN~U
?HideExpression@@YGHNPAI~U
?CloseThreadEx@@YGXJPANHH~U
?ClosePointerOld@@YGPAHPADPAEHI~U
?FreeMutexW@@YGKKPAE~U
?EnumWidthOriginal@@YGXJ_NHJ~U
?OnTimeEx@@YGPAIPAJPADIPAF~U
?GenerateAppNameW@@YGPAINPA_NPAID~U
?IsValidFolderNew@@YG_NPAGPAMPAKE~U
?ShowWidthEx@@YGPAMIPAJ_NPAD~U
?CrtConfigExW@@YGPANK~U
?ValidateOptionW@@YGIEMEF~U
?CloseMemoryOld@@YGPAXPAIPA_NHF~U
?AddPathOld@@YGGPAKEPAFK~U
?RemoveNameOld@@YGPANPAD~U
?SetDialog@@YGPAHHG~U
?SendComponentExA@@YGPAMHH~U
?CopyAppNameOld@@YGDGPAEFH~U
?DeleteOptionExA@@YGMPANPAM~U
?ModifyStringEx@@YGPAKPAK~U
?FindWindowExA@@YGPAKDPAK~U
?AddStateEx@@YGEF~U
?SetCharNew@@YGPADN~U
?HideWidthExA@@YGPAFJG~U
?InsertMainStructDlhSi@@YGKGH@Z
?GenerateProfileOld@@YGPAXM~U
?RemoveSizeNew@@YGKH~U
?ClassNew@@YGXGM~U
?EnumListItemEx@@YGPAKF~U
?DecrementComponentOriginal@@YGHH~U
?InvalidateProviderOriginal@@YGPAKEDGPAM~U
?InstallSemaphoreOriginal@@YGIFKMG~U
?IncrementPenW@@YGGPAN~U
?OnSystemOld@@YGXPAE~U
?GenerateFullNameW@@YGDFPAN~U
?FreeThreadExW@@YG_NIPAIIK~U
?IsValidAnchorNew@@YGDD~U
?ShowMonitorW@@YGPAIPA_NGPAMH~U
?IsNotExpressionW@@YGPAXJM~U
?AddFunctionW@@YGPAXI~U
?AddDirectoryNew@@YGHMPAJ~U
?IsNotNameNew@@YGPAFIEPAH~U
?RemoveDialogExA@@YGPAGG~U
?CrtTimeNew@@YG_NJHPAII~U
?InsertKeyNameEx@@YGPAJPAND~U
?FindMemoryW@@YGXPAJG~U
?InstallData@@YGJKN~U
?CrtWidthExA@@YGHHM~U
?InstallDataExA@@YGMED~U
?FileW@@YGXF~U
?HideFullNameW@@YGPAMKPAF~U
?DeleteMemoryA@@YGPAX_N~U
?SendAnchorExA@@YGPAEMG~U
?IsPointerEx@@YGXEPAD~U
?FreeMessage@@YG_NFG~U
?IsValidCharA@@YGXJPADMM~U
?GetPointerExW@@YGPAXI~U
?RtlSystem@@YGPAJHI~U
?FindListExW@@YGPAMJE~U
?InstallComponentExW@@YGPA_NG~U
?GlobalProcessEx@@YGDPAKNDD~U
?RemoveObjectW@@YGHPAGDIN~U
?DeleteDateA@@YGPAFPAH~U
?RemoveVersion@@YGPAMKPAF~U
?LoadExpressionEx@@YGXPAMPAF~U
?RtlFilePathW@@YGPAKE~U
?CancelArgument@@YGJPANH~U
?EnumDataW@@YGIFIHPAF~U
?KillModuleW@@YGMM~U
?IsValidMutantNew@@YGXPAEPAM~U
?LoadWidthEx@@YGHHFPAD~U
?FreeMemory@@YGDDKD~U
?RemoveModuleOld@@YGJPAKPAIPAF~U
?IsNotPenNew@@YGPAIG~U
?ShowRectOld@@YG_NPAEPAIDH~U
?InsertVersionOriginal@@YGPADPAD~U
?ValidateKeyboardA@@YGPAXPAKF~U
?GlobalTimeExA@@YGJEDPADPAH~U
?SendSectionEx@@YGXHNMF~U
?IncrementNameW@@YGEI~U
?CancelPenExA@@YGJFDPAF~U
?InstallStringOriginal@@YGPAEPAJ~U
?RemoveConfigA@@YGXDPAD~U
?PutMonitorA@@YGPAGE~U
?GlobalSemaphore@@YGIDM~U
?PutListExA@@YGPAG_ND~U
?InsertValueOld@@YGMGPA_N~U
?InstallSectionOriginal@@YGKDD~U
?CloseMonitorNew@@YGJPA_NGM~U
?GenerateWindowInfoNew@@YGJE~U
?CrtHeightW@@YGIPAEE~U
?FormatProcessW@@YGHDPAMPAG~U
?InsertObjectNew@@YGGE~U
?IsAppNameExW@@YGPAXEF~U
?DecrementFolderOld@@YGPAXJDPAFPAG~U
?RtlPointOld@@YGE_NPADPAD~U
?CopyDataEx@@YGJIDG~U
?FreeSystemW@@YGXMHFE~U
?GlobalSemaphoreOld@@YGFPAHJI~U
?CloseSectionOld@@YGPAFPAEMKE~U
?ShowFilePathExA@@YGMPAJPAFFPAK~U
?HideCharA@@YGFJPAJH~U
?CallDateTimeEx@@YGPAMDPAJ~U
?DecrementMonitorNew@@YGFPAFMDPAG~U
?KillModuleExA@@YGEGD~U
?GenerateProviderExA@@YGJDJ~U
?ValidateListItemNew@@YGNGK~U
?SetSectionW@@YGPADJPAHI~U
?ValidateKeyboardW@@YGKPAKFG~U
?PutPenOld@@YGJHNPAHPAM~U
?InsertWindowNew@@YGPAEF~U
?DeleteDeviceOld@@YGPA_NPAHPAD~U
?SetPathExA@@YGXPAHEFM~U
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rimp Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdbg1 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.redt Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rit Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdbg2 Size: 512B - Virtual size: 71B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rvar Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rpt Size: 1024B - Virtual size: 671B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hdata Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ping Size: - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 85KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ