C:\Install.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8ec49f35af8b0950646b4a113e03a447_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8ec49f35af8b0950646b4a113e03a447_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8ec49f35af8b0950646b4a113e03a447_JaffaCakes118
-
Size
24KB
-
MD5
8ec49f35af8b0950646b4a113e03a447
-
SHA1
a1d6c29c2c491feb533ea9e7f1577df20e4f7573
-
SHA256
e9f837b59e0cf3c60d1b0b8440747ae86919a7dd8cbf55b113598bbe5e9fcc09
-
SHA512
e99c3d12283f079fb2ff18cb7f4b31af82ca058d93c0259936baae1b96aa1e9b2bd1e9f685c7aac70238f541b59515148d64ab8e6af3ff264e74997918ffd266
-
SSDEEP
384:y6oFGpwIkgnW+xzaJAFTLbbDfWOFX0vgl+v9bfAIKDTH:y6ognWyz4kWOFX0vgl+v9bnKDTH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8ec49f35af8b0950646b4a113e03a447_JaffaCakes118
Files
-
8ec49f35af8b0950646b4a113e03a447_JaffaCakes118.exe windows:5 windows x86 arch:x86
ff6dea692597ce5bf6ebc78b7351c187
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
strrchr
strstr
memset
kernel32
GetWindowsDirectoryA
WriteFile
SizeofResource
lstrcatA
MultiByteToWideChar
GetProcAddress
LoadResource
LockResource
GetModuleFileNameA
GetModuleHandleA
GetCurrentThreadId
FreeLibrary
CloseHandle
GetTempPathA
lstrcpyA
FindResourceW
SetEndOfFile
lstrlenA
SetFilePointer
CreateFileA
ExitProcess
LoadLibraryA
WinExec
user32
PostThreadMessageA
wsprintfA
GetInputState
GetMessageA
advapi32
RegOpenKeyExA
RegCreateKeyExA
CreateServiceA
OpenServiceA
QueryServiceStatus
OpenSCManagerA
ControlService
RegCloseKey
RegQueryValueExA
RegSetValueExA
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ