fsquirt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a4675f8ff1c324748d9fe639558641d8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a4675f8ff1c324748d9fe639558641d8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a4675f8ff1c324748d9fe639558641d8_JaffaCakes118
-
Size
190KB
-
MD5
a4675f8ff1c324748d9fe639558641d8
-
SHA1
c2d85010d53219408228491e18ec170eaf1cbbfa
-
SHA256
e5fd91a3d98cdac2ca503f31c45799e87567f57e5747ad0f11dc518f8370c0d8
-
SHA512
9429332f43b63192311c8bfe1f671dfa5c3c6e93295d4aae7c7119807ba5c7fcfb5cb840c9258cf50a82fad984d4cc600818bc761b2eee3b82240557a9afe273
-
SSDEEP
1536:XeQUNc8MvC/tLDgb0Y/fFdMfvyw65qQ5i1m5BTwxL9JD2fOtFPn+7+uDhX7jquzg:X2i8MvC4h0fvyr9yJD2mbOjKDrJw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a4675f8ff1c324748d9fe639558641d8_JaffaCakes118
Files
-
a4675f8ff1c324748d9fe639558641d8_JaffaCakes118.exe windows:5 windows x86 arch:x86
406caf67c01bf3c0a55e677697a91b8a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
kernel32
InterlockedDecrement
CreateThread
GetCurrentThreadId
lstrlenW
GetModuleFileNameW
HeapReAlloc
WriteFile
CreateFileW
lstrlenA
SetEvent
LocalFree
GetOverlappedResult
ReadFile
LocalAlloc
GetFileSizeEx
MulDiv
FormatMessageW
WaitForSingleObject
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
LoadLibraryExA
HeapAlloc
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
SetFilePointer
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
VirtualProtect
GetSystemInfo
GetLocaleInfoA
FlushFileBuffers
InterlockedIncrement
WaitForMultipleObjects
GetLastError
GetModuleHandleA
ResetEvent
HeapFree
GetProcessHeap
CreateEventW
GetStdHandle
CloseHandle
gdi32
GetObjectW
GetDeviceCaps
CreateFontIndirectW
DeleteObject
user32
TranslateMessage
GetMessageW
LoadImageW
GetDC
ReleaseDC
MessageBoxW
SetWindowTextW
ShowWindow
SetDlgItemTextW
SetFocus
SendMessageW
PostThreadMessageW
GetDlgItemTextW
GetDlgItem
GetWindowTextLengthW
EnableWindow
GetWindowLongW
SetWindowLongW
SendDlgItemMessageW
GetParent
PostMessageW
LoadStringW
KillTimer
DispatchMessageW
SetTimer
PostQuitMessage
comctl32
InitCommonControlsEx
PropertySheetW
shell32
SHGetFolderPathW
SHBindToParent
SHGetSpecialFolderPathW
ord155
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW
ord258
SHSetLocalizedName
comdlg32
GetOpenFileNameW
shlwapi
StrFormatByteSizeW
StrRetToBufW
SHSetValueW
PathFindFileNameW
PathAddExtensionW
PathAppendW
PathRemoveFileSpecW
StrStrIA
PathCombineW
ws2_32
connect
socket
WSASetServiceW
listen
getsockname
bind
WSAGetOverlappedResult
WSASend
WSARecv
setsockopt
getpeername
ioctlsocket
WSAStartup
WSACleanup
closesocket
WSAGetLastError
mswsock
AcceptEx
ole32
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoRegisterClassObject
CoRevokeClassObject
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoUninitialize
irprops.cpl
BluetoothAuthenticateDevice
BluetoothEnableDiscovery
BluetoothSelectDevices
BluetoothSelectDevicesFree
BluetoothFindFirstRadio
BluetoothFindRadioClose
BluetoothGetDeviceInfo
Sections
.text Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ