c:\C++\_networking\Backdoors\BBack_\Release\BBack_.pdb
Static task
static1
Behavioral task
behavioral1
Sample
952904c133ffc50c28b399bee0c5fee1_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
952904c133ffc50c28b399bee0c5fee1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
952904c133ffc50c28b399bee0c5fee1_JaffaCakes118
-
Size
48KB
-
MD5
952904c133ffc50c28b399bee0c5fee1
-
SHA1
e59dcb0a8d9d64787c5ef07adc7da9fa6f30f185
-
SHA256
415d104ef0e98aa5f40f2b0e71c5fb6b542a5dc670e2f4f19a16e0fb9080e0d8
-
SHA512
61026576311a7f9439b7de73e5ccb5e7bc31c1b8eb466cf23a8c0b3604bc0d26021502add3b9f9b70a3dcd228880229a04bd9847fb9392bf9c194315f31f7c72
-
SSDEEP
768:cYIAepZ6/4tEUNdkmKG2wXNk8hNSXy8DxNwrDy:chAepZ6/4/umKGXWcSXPdgD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 952904c133ffc50c28b399bee0c5fee1_JaffaCakes118
Files
-
952904c133ffc50c28b399bee0c5fee1_JaffaCakes118.exe windows:4 windows x86 arch:x86
be51b7f7ec2a0cd28bdf33eb0a458061
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersionExA
GetComputerNameA
Sleep
TerminateProcess
WriteFile
ReadFile
PeekNamedPipe
CloseHandle
GetCurrentDirectoryA
GetStartupInfoA
CreatePipe
WinExec
CreateFileA
GetTempPathA
ExitProcess
LCMapStringW
LCMapStringA
lstrcmpiA
GetSystemDirectoryA
GetTickCount
GetCommandLineA
CreateProcessA
CopyFileA
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetCPInfo
GetOEMCP
GetACP
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
VirtualQuery
InterlockedExchange
RtlUnwind
LoadLibraryA
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetLastError
HeapSize
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapFree
HeapAlloc
GetModuleHandleA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetProcAddress
GetCurrentProcess
GetStdHandle
UnhandledExceptionFilter
user32
wsprintfA
advapi32
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
wsock32
send
recv
socket
ioctlsocket
WSAGetLastError
htons
inet_ntoa
connect
select
shutdown
closesocket
WSACleanup
WSAStartup
gethostname
gethostbyname
wininet
InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetQueryOptionA
InternetReadFile
Sections
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ