C:\Users\John\Documents\Visual Studio 2010\Projects\NotMyShell\Release\NotMyShell.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8b5df93475f6f2553a846c558d860dc1_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8b5df93475f6f2553a846c558d860dc1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8b5df93475f6f2553a846c558d860dc1_JaffaCakes118
-
Size
7KB
-
MD5
8b5df93475f6f2553a846c558d860dc1
-
SHA1
89ce0def640cd984ab6ac0009a489ded17d503ed
-
SHA256
6781fa2f8f139e8c7e295a0509b0bc35c4f7c62da896c5b6d945f9b9e485e615
-
SHA512
e38855f401d2d32e2562c0de93ceae42cd085a1f05444efdd5977b9666c6ff316bc7fc2e5bc68c3e552890c20e9b90b06bd29597dea3fbbcd0564f539cc53ad9
-
SSDEEP
96:k5DFTr7sxM7OtZ8e/KwdvDO70q8nbl62mL0SzruVABG6pDCto:kfsO7OfdW0q8nbg2mL0SzruVQG6pao
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8b5df93475f6f2553a846c558d860dc1_JaffaCakes118
Files
-
8b5df93475f6f2553a846c558d860dc1_JaffaCakes118.exe windows:5 windows x86 arch:x86
cb8110c31e59ad6fa586d74f4f1204e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
WSAStartup
inet_addr
WSAConnect
htons
WSACleanup
WSASocketA
kernel32
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
AllocConsole
CreateProcessA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
EncodePointer
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
TerminateProcess
user32
ShowWindow
FindWindowA
msvcr100
__initenv
_initterm
exit
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
memset
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_initterm_e
_crt_debugger_hook
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 478B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ