K:\phtsjOWsgr\qeuigpwLTuj\ewnxnCkcz\QvKiWPnjuooj.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a849a9c04926f073769f2ace56d6d3d0_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a849a9c04926f073769f2ace56d6d3d0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a849a9c04926f073769f2ace56d6d3d0_JaffaCakes118
-
Size
168KB
-
MD5
a849a9c04926f073769f2ace56d6d3d0
-
SHA1
7004e2ba61e79a63e64bff172286a6cf6ef6e043
-
SHA256
0f98b160b1680412367063d0456d646292117de60a6ba19e99c59f18a206165b
-
SHA512
35fdb2900cf04e8a967314324abded61e1e3ee8e9de9e33b97e1a52ae235231c55a9b874c4417bb27ed4da538d09c57e059fe89d812723850e856e3d3adf29a9
-
SSDEEP
3072:5/8aehw/7M/MCJ0g9JdaW/HHvyr+WYW5pHv+e/1cZ4R7fmTw:dRHkMCag9JjHpWpXP+e/KmR7fmTw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a849a9c04926f073769f2ace56d6d3d0_JaffaCakes118
Files
-
a849a9c04926f073769f2ace56d6d3d0_JaffaCakes118.exe windows:5 windows x86 arch:x86
ad6bd072f0e86d208a44a7058e59bf5d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
gdi32
GetCharWidth32W
AddFontResourceW
DeleteObject
CreateDiscardableBitmap
SetPaletteEntries
TranslateCharsetInfo
SetBkMode
CreateFontIndirectW
RoundRect
CreateDCW
CreateCompatibleBitmap
UnrealizeObject
CreateDIBitmap
GetTextColor
Polygon
ntdll
memset
strcspn
user32
ExitWindowsEx
MonitorFromRect
IsWindowVisible
GetClassInfoA
KillTimer
TileWindows
GetClipCursor
ShowCaret
ShowWindowAsync
CreateCursor
WaitMessage
DialogBoxParamA
LoadBitmapW
SetFocus
DestroyWindow
DialogBoxIndirectParamA
SetLastErrorEx
wsprintfA
PostThreadMessageA
RegisterClassExW
DialogBoxIndirectParamW
DrawTextExW
CloseDesktop
BringWindowToTop
CopyAcceleratorTableW
GetMenuItemInfoW
SetMenuItemBitmaps
CharUpperBuffA
PostMessageA
LoadIconA
kernel32
SleepEx
FindClose
DeleteFileA
GetPriorityClass
GetSystemTimeAsFileTime
GetTempPathW
MapViewOfFile
VerSetConditionMask
CancelIo
GetSystemTimeAdjustment
GetProcAddress
EnumResourceLanguagesA
lstrcpyA
CreateFileA
lstrcmpiW
OpenFile
lstrlenW
msvcrt
exit
Exports
Exports
?thtNAXEF@@YGPA_NPAG@Z
?_jKRJMZRDH@@YGPAIPAME@Z
?PXbndefyb_wykkr__z@@YGXPAJ@Z
?OXz__envz@@YGPAXG@Z
?AVIpizjp_k___OZN@@YGPADPAM@Z
?uvzhfmaEDJOJLTWNm@@YGDPAK@Z
?__zlbjI@@YGXHPAE@Z
?iypq_ollp_zw__p_a_t@@YGMPAEN@Z
?UM_WFICXS_Rufmh_@@YGPANFJ@Z
?yjEDUtr_AQ_OWW_YUF@@YGIDPAI@Z
?WTRI_ET_ri_qcT_CXI@@YGFDE@Z
?_J_NMZTUD_Sarb@@YGPAXKPAE@Z
?IIKTZHLJC_Brn_argbwt@@YGEPAKE@Z
?BGE_Z_A_wr@@YGPAKPAF@Z
?J__IQARYJFtn_pc@@YGPANE@Z
?WKBLb__empu_fhHHBA@@YGPAHPAHPAK@Z
?mvY_BerccwlyawH_adrbi@@YGPAJGG@Z
?_welULMRN__FHZMJENCPU_@@YGXPAGPAD@Z
?N_Np_p__cdCEu__az@@YGIDPA_N@Z
?fkmzsghvyw@@YGPAEPAN@Z
?mkbzqbabFs_@@YGPAMD_N@Z
?_ZIQ_O_Wz__uw___n@@YGIHM@Z
?s_v__JAW_YUth@@YGXE@Z
?JRJUIVU__vb@@YGKIM@Z
?npk_YA_EWGBwmtszLX@@YGPAXDF@Z
?___XE_Ixwswd_rqmm@@YGPAHPAKD@Z
?_mztjg_c_h_l@@YGJPAJF@Z
?FOL_YCVNTRTV_MWPt@@YGFHI@Z
?COXIAPJ_XCIT@@YGIE@Z
?KIim_lvoW__FLC@@YGHH@Z
?_I__Q_RXaoiwLCCCT@@YGPAEF@Z
?N__WL____vsmqQN_C_@@YGPAXHPAD@Z
?_XTDJYNUIPJM_UT_@@YGXGM@Z
?VA_JWA_mDcsgf_g__cbm_n@@YGHPAIE@Z
?EBWBHvwaxuN_B_EXTYl@@YGKG@Z
?jeqJGT_is_p_t__xwriw_@@YGJPAIE@Z
?_zlQL_Lchkgv___AMB@@YGHD@Z
?OZO__UDG_ZCRA_JJA__WO_@@YGPAMJH@Z
?ke_ydf__eadnw_l___u@@YGPAH_NH@Z
?QzvtO_HNiwkgBE_EEF_@@YGFFPAM@Z
?XVNCJ_LGClh@@YGPAXPAE_N@Z
?_nx_g_hZ_IANKEL_QSP@@YGJDD@Z
?_S__d_r_T_LZY_X@@YGGPAN@Z
?LCG_TAjtaej@@YGGDE@Z
?cdj__epf__i@@YGPADPAD@Z
?_QWKSAZS_BDMB_N__WC@@YGXF@Z
?D_R_b__acaiNDC@@YGMK@Z
?idQQCTZM@@YGPAIDN@Z
?DSRPWu_y_@@YGDK@Z
?_XMYY_Ylk__vpv_@@YGNPAI@Z
?_VXRMJH@@YGHNH@Z
?giQUT__qd@@YGXG@Z
?_Zbw_xc_iDLF@@YGFK@Z
?_abeM__FTFTPrbzmvtxh@@YGPAFGPAG@Z
?fscyuktiMQ_LAJH@@YGIKPAF@Z
?_AsmdG_DJrnd@@YGPAHPA_NPAM@Z
?va___r_mlzrdonOYoxh_p@@YGPAXPAED@Z
?ix_l_OLJ_J_X___og@@YGFM@Z
?bz__trbs_p_Jji_YFh_a@@YGPAGPAI@Z
?__n__j_PR@@YGPAMMG@Z
?SXnwMI_T_o_b@@YGND_N@Z
?USR__x_kNR_UPRCBz@@YGEE@Z
?jtotUS_@@YGMDG@Z
?PV_Moqrj_vx_i@@YGPAJGJ@Z
?QOITMLBC@@YGIII@Z
?QU_VOYPRPcT@@YGGPAK@Z
?_RFPMLNXIb_j_s@@YGJDJ@Z
?DYxvyiBD_W_n@@YGHNPAE@Z
?TQhvm__NNJES@@YGPAFPAK@Z
Sections
.text Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ldata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 40KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.export Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 495B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ