D:\Stas\Develop\repositories\Agent\bin\Release\updater.pdb
Static task
static1
Behavioral task
behavioral1
Sample
886535829d76a50ae0c1b605f4d3883f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
886535829d76a50ae0c1b605f4d3883f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
886535829d76a50ae0c1b605f4d3883f_JaffaCakes118
-
Size
204KB
-
MD5
886535829d76a50ae0c1b605f4d3883f
-
SHA1
6768702d88f1b16f6e7372f31a4f10b1a53f6774
-
SHA256
a0c1e13faaebd7a68ec9993e475bbc7d72376722dcd7e6d6df6e3316db9991a1
-
SHA512
70292169650d473e1de4cd25ff5026af65ea5edea53ce08f5fa147bdc9298c1ec2171117d9b5aa2a825ce9d3dcb4075740ba7d0e06cb8a48b3fbca1f46f062aa
-
SSDEEP
6144:mV+8GiDjHicKT1gv4VjgtRfohb0QhBJLXb:xivHic77fohb0q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 886535829d76a50ae0c1b605f4d3883f_JaffaCakes118
Files
-
886535829d76a50ae0c1b605f4d3883f_JaffaCakes118.exe windows:5 windows x86 arch:x86
dcf4566954ea6a1e8c71636fbbdbb350
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
LoadLibraryExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
lstrcpynW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
SetErrorMode
SetUnhandledExceptionFilter
GetCommandLineW
CreateThread
FreeLibrary
GetLocalTime
OpenThread
WaitForSingleObject
TerminateProcess
GetCurrentProcess
GetModuleHandleExW
FindResourceExW
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
RaiseException
GetModuleHandleW
lstrlenW
GetLastError
WTSGetActiveConsoleSessionId
GetVersion
GetProcAddress
LoadLibraryW
CloseHandle
FlushFileBuffers
WriteFile
CreateFileW
SizeofResource
LockResource
FreeResource
LoadResource
FindResourceW
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
Sleep
ExitProcess
GetCommandLineA
GetStartupInfoA
UnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
VirtualAlloc
HeapCreate
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
user32
GetMessageW
TranslateMessage
DispatchMessageA
PostThreadMessageW
wsprintfW
PostQuitMessage
CharNextW
advapi32
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
CloseServiceHandle
ChangeServiceConfigW
OpenServiceW
OpenSCManagerW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
ReportEventW
CloseEventLog
OpenEventLogW
RegQueryValueExW
shell32
CommandLineToArgvW
ole32
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateGuid
CoUninitialize
CoInitializeEx
StringFromGUID2
oleaut32
SysFreeString
VariantClear
VariantInit
VarUI4FromStr
SysAllocString
SysAllocStringLen
shlwapi
PathRemoveFileSpecW
PathFindFileNameW
PathCombineW
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ