Eap3Host.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a3806c1160947165a571429113a03fb7_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a3806c1160947165a571429113a03fb7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a3806c1160947165a571429113a03fb7_JaffaCakes118
-
Size
30KB
-
MD5
a3806c1160947165a571429113a03fb7
-
SHA1
2a88770c3b8227eb596f0c3b23cb38582b78b93f
-
SHA256
79f729b2e0506108cdc217c971162102926f5d33eefde523323ad86866142d20
-
SHA512
023dd8827873b5f283ed98e7fff5bdd0ea416de38537d8ace15900b6e80f02e39a69a91d7ec8deca052c8ebfa167ea62b3a4085bb472952794c6794a8d8ef7c5
-
SSDEEP
768:Faw34QMhaAQ3i1Io3nZApaWSXerphfhTcsC/v:FWbaAQ0ZApkspzT+v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a3806c1160947165a571429113a03fb7_JaffaCakes118
Files
-
a3806c1160947165a571429113a03fb7_JaffaCakes118.exe windows:6 windows x86 arch:x86
b6cafad45349d7b139f3ce44bfe7d55d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
kernel32
InterlockedIncrement
InterlockedDecrement
SetEvent
CreateEventW
GetLastError
MultiByteToWideChar
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter
user32
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageW
PostQuitMessage
PeekMessageW
msvcrt
__setusermatherr
__p__commode
_exit
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_amsg_exit
_initterm
_acmdln
exit
__p__fmode
_ismbblead
_controlfp
_XcptFilter
??3@YAXPAX@Z
??2@YAPAXI@Z
wcschr
_cexit
__getmainargs
memset
printf
ole32
CoRegisterClassObject
CoInitializeEx
CoTaskMemAlloc
CLSIDFromString
CoInitializeSecurity
CoUninitialize
CoGetClassObject
CoRevokeClassObject
CoRegisterSurrogate
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE