C:\wzl\FolderBind\Release\FolderBind.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8351cebc0840a49754e47ed23248eb62_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8351cebc0840a49754e47ed23248eb62_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
8351cebc0840a49754e47ed23248eb62_JaffaCakes118
-
Size
261KB
-
MD5
8351cebc0840a49754e47ed23248eb62
-
SHA1
85fd26e403a0534ae107659084450738afe6ba59
-
SHA256
306bec2fd0560d610eefa6a1f9b9a325042e8ff3c5665674664debb41a9df232
-
SHA512
c0b088b2e141b6a6d8ef3e9645cfdc69813942a4c8e5a8fbb0d844e4ac61f984d4432ec697e112d815d98f7f7f1b6cb10f3317a94fdd78fc269007bb4dc5d69f
-
SSDEEP
3072:Di6/IEHrb1ATQe8xgYG5LRBwb1Nw5wqpeMbbze:Di6/IorsQpxgP5Lbwf/qp3i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8351cebc0840a49754e47ed23248eb62_JaffaCakes118
Files
-
8351cebc0840a49754e47ed23248eb62_JaffaCakes118.exe windows:5 windows x86 arch:x86
330a962d581980aec22d6b029c23e536
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathRemoveExtensionW
kernel32
DeleteCriticalSection
GetFullPathNameW
ExitProcess
GetEnvironmentVariableW
FindResourceW
LoadResource
CreateProcessW
CreateDirectoryW
WriteFile
WideCharToMultiByte
SizeofResource
GetModuleFileNameW
CreateFileW
lstrlenW
LockResource
lstrcatW
GetShortPathNameW
WinExec
CloseHandle
lstrcpyW
SetFileAttributesW
FlushFileBuffers
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DecodePointer
EncodePointer
GetProcAddress
GetModuleHandleW
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
MultiByteToWideChar
HeapAlloc
RtlUnwind
LoadLibraryW
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
HeapReAlloc
IsProcessorFeaturePresent
HeapSize
shell32
SHGetSpecialFolderPathW
ShellExecuteW
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hsdqlay Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE