Z:\stAyMNdKksfdK\mqUOEblOqQk\ufllKtuH\jIqhSuzzySdsca.pdb
Static task
static1
Behavioral task
behavioral1
Sample
93af042080c2895080272de0b9fe4356_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
93af042080c2895080272de0b9fe4356_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
93af042080c2895080272de0b9fe4356_JaffaCakes118
-
Size
172KB
-
MD5
93af042080c2895080272de0b9fe4356
-
SHA1
a5f049db5fa3814817c39507f5fea49a91a5ac6e
-
SHA256
44466b17d03421951f65df2c807a4ac3f7152e45f40ba868e133b8b96ecd9d90
-
SHA512
695d61da8e4d99dd4a05f14b0a6c288153825be6dd9486dabe4c1b18cdbe89cd7baa4000bb770b30dd011b8399f0b9d6e4486fb4e55a9b4c7aca72f1ccc7f5ee
-
SSDEEP
3072:yuLaWCx9m+DqBqS/+dUeRgg7UF05ZV1pheNLrYCviFGWhdyTKuopHzmjovgue4Fu:hpZ+AWUF05XANzvRWhdyepHK+guDFbeW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 93af042080c2895080272de0b9fe4356_JaffaCakes118
Files
-
93af042080c2895080272de0b9fe4356_JaffaCakes118.exe windows:5 windows x86 arch:x86
441f9b095a0237d400dcfeb241401e39
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
comctl32
DestroyPropertySheetPage
ImageList_ReplaceIcon
ImageList_GetImageCount
ImageList_GetIcon
ImageList_LoadImageW
gdi32
StretchBlt
GetRgnBox
GetClipBox
SetDIBits
StartDocW
CreatePalette
Escape
PathToRegion
SetRectRgn
ExtFloodFill
SetStretchBltMode
LineDDA
shlwapi
UrlGetPartW
PathMatchSpecA
user32
GetMenuState
LoadCursorA
CreateIconFromResource
GetKeyState
GetMenuItemID
OemToCharA
GetMessageA
GetUserObjectInformationW
GetClassLongW
SendMessageA
DefDlgProcW
LockWindowUpdate
CreateDialogIndirectParamW
TabbedTextOutW
GetWindowLongA
GetDC
GetTopWindow
InvalidateRect
SetTimer
RegisterClassExA
CharUpperBuffA
GetClientRect
DefDlgProcA
PeekMessageA
MapVirtualKeyW
DrawStateW
DeleteMenu
DestroyMenu
IsDialogMessageA
ShowWindow
msvcrt
exit
ntdll
memset
strcspn
kernel32
ReadFile
lstrcpyA
RaiseException
AddAtomA
IsDBCSLeadByteEx
LocalReAlloc
lstrcmpiW
CreateWaitableTimerA
GetStartupInfoA
CompareStringW
LocalFree
LCMapStringA
GetCommState
GetCompressedFileSizeW
lstrlenW
GetVersion
SetHandleCount
CreateFileA
Exports
Exports
?WMXNSC_Y_FM_GFJQgtef@@YGEPAI@Z
?___XXr_NABEDT@@YGNF@Z
?_QKJE_QKFSFZuMI_@@YGPAE_N@Z
?_VX_FFZf__k__c@@YGPAE_N@Z
?__wlEB_ayjqx_@@YGXPAH@Z
?__TX_U_Eq@@YGXNM@Z
?hu____m_z@@YGXH@Z
?NksaiFBGD__@@YGFN@Z
?Mibdlpvwbhj__y@@YGKPAN_N@Z
?KOBNhjavm_eh_Yi_n@@YGKPAEE@Z
?EA_SLvagDbubhy_sk@@YGPAIPAJ@Z
?_bxe_y_Lh@@YGPAXNPAH@Z
?WgrG_VPH__P@@YGPADJN@Z
?tPQNMQlqhsuC@@YGMPAG@Z
?_XBW_EVGVMDDQ_OIOpukz_@@YGGJPAF@Z
?_BBE_ZNC_F__G@@YGPAHPAM@Z
?LKPUHivPAIbv@@YGXHF@Z
?fc___UCJ_ZVWLR@@YGXI@Z
?FKRKGE__PT_UTYdzkz_@@YGPAIK@Z
?kj_x_tqPZCEGR_@@YG_NPAF@Z
?U__SCE_F__g_f@@YGIPAI@Z
?_H_Ozgj_qqISOYkxncU_U@@YGHKPAN@Z
?VHPTHGBKyIc_X_DIBMZD_@@YGPAFKM@Z
?ONY_EYCussd@@YGINH@Z
?_KI_H_t_eqr@@YGPAIKF@Z
?kUV_g_kjxzv_wCNPSSII@@YGPAEM@Z
?SYG_Efijs_r_sdmDRCO@@YGPAHPADI@Z
?yxcb_hyynkgrRGrhxpg@@YGPAJNPAJ@Z
?wfwvv__nbHJOY_TSGuf@@YGGPAM@Z
?ZD_CRX_IFGJ@@YGKI@Z
?_D_rdvlQN_CE_VN_vr@@YGGHPAM@Z
?zmuuPAK_pbj_nqi@@YG_NKE@Z
?_AP_J_JGGQKMXVR@@YGXMJ@Z
?ollm_xQQ_@@YGPAIJJ@Z
?MF_K__Yknywr@@YGFMPAH@Z
?__bgyTWE_G_CENBR@@YGPAIKK@Z
?_nsZ_C__EG_BV_U@@YGXJ@Z
?GNtb_i_ygAERX_N@@YGEPA_NPAK@Z
?mfj_MHD_HJ_CSvtmjm@@YGDM@Z
?vvdc_kz@@YGPANF@Z
?wp_fd_ikpx_a_a@@YGXJ@Z
?VARRkw_b_@@YGPADPADPAN@Z
?YcaoebYORW__KUCNce@@YGPAXFD@Z
?__B_FLuggulaf__bwae_f@@YGHEI@Z
?_HIAHKkKOC_EVQXL@@YGNN@Z
?_OFXTCdef_gymPWT_S_VQ@@YG_NE@Z
?_yltdRMOBrgqPKT@@YGJPAJG@Z
?LiAI_a__kgzIDp@@YGPAHHF@Z
?PsF_WlauP_N__@@YGF_N@Z
?jt_gtednd___vl@@YGXIH@Z
?__PCUKFJgsdq_f@@YGIG@Z
?_z_hc_jOLYKG@@YGEH@Z
?I_IXNx_wawxnTAPK@@YGXPAIPAI@Z
?bjdxgrcKbmvnyNRBBRO_XJ@@YGKHPAH@Z
?lpnym_du_a_U____R@@YGKMJ@Z
?UDBG_Qfiddzz_pmfWevzeP@@YGFPAGJ@Z
?Ef__ebN_XH_@@YGNPAI@Z
?itnpPeevjhkymr_@@YGXPAK@Z
?F_ZQI__KCzwr@@YGPAXMPAJ@Z
?l___fvul_kSH@@YGPAXPAEK@Z
?kbslm_zyp_v_v_Lmvm@@YGFPAFK@Z
?jcgpbS_KE_MKq_y@@YGPAEG@Z
?IFN_PBY_z@@YGPANH@Z
?IPGWQrhse_iHNSHVQQQ_J@@YGPAEK@Z
?QVCV_K_@@YGEI@Z
?GZ_M_XPRCPQozgg@@YGPA_NDF@Z
?iirngwiSSP_Q_Gw@@YGFG@Z
?_ecskeQMZUNA@@YGKF@Z
?P_WNEBqPGBG__kb@@YGJG_N@Z
?CY__D_M__@@YGJEI@Z
?hyg_utmsa____vy_u@@YGNF@Z
?VATU_gjp@@YGXE@Z
?dKVSQ_O_VgFgjm_ms__@@YGDG@Z
?_WILd_vfs@@YGPAMDF@Z
?LUMAY_B@@YGPAJNE@Z
?jom_v_NCASSVSHR_@@YG_NPAN@Z
?S___YR_HZD__YVIGTKbo@@YGEPADK@Z
?uaumZfbje_ug@@YGXM@Z
?A_VGkIginZQSTwFYYQfq_@@YGKHJ@Z
?jshrus__bt_w_CD@@YGEIPAH@Z
?_IAoFAFXSRTZAbfx@@YGJFPAM@Z
?SKCR_IHEzp@@YGPAMPAEPAF@Z
?HPXUF_ZNEADFwq_oc_@@YGJDM@Z
?_D_shhwvXWd@@YGPA_NDE@Z
?_qYKbgpbuWJN_ro_knzfq@@YGFF@Z
?rq_om__blOBNKJ_S_K@@YGPAKHI@Z
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ldata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 41KB - Virtual size: 310KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 523B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ