D:\onokah\Qokiqut.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a74ef9dcc9a0551fe1883746a05f1b12_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a74ef9dcc9a0551fe1883746a05f1b12_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a74ef9dcc9a0551fe1883746a05f1b12_JaffaCakes118
-
Size
144KB
-
MD5
a74ef9dcc9a0551fe1883746a05f1b12
-
SHA1
731a17ef171a3fa5c09fb266cc37699b66919215
-
SHA256
c9873785296ad096285c6be6c44e45fd43fb5cd345ad0ae0db9ba1247d9b4454
-
SHA512
1c9b23d062733999cebe30f68b0971cd1a000130a92b0b62c9de2af70872b035d92cd4da388e13f32375878dfed6d716161299f84d6294aa4fae14568e6fa024
-
SSDEEP
3072:s+S9OLxnC4lWtwiH2aQ5fgv3KkD7xjIzlKbH:+9O8tZHq5fK3KEhIzK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a74ef9dcc9a0551fe1883746a05f1b12_JaffaCakes118
Files
-
a74ef9dcc9a0551fe1883746a05f1b12_JaffaCakes118.exe windows:4 windows x86 arch:x86
59bcf124d07224db306d71c8963614b6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
InitializeCriticalSection
EnterCriticalSection
CreateDirectoryW
CopyFileW
ResetEvent
VirtualFree
VirtualAlloc
WriteConsoleW
lstrcmpiW
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
HeapSize
VirtualQuery
InterlockedExchange
RtlUnwind
IsBadWritePtr
HeapReAlloc
HeapAlloc
GetModuleHandleA
GetStartupInfoW
GetVersionExA
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
LoadLibraryA
GetSystemTimeAsFileTime
winspool.drv
DocumentPropertiesW
ClosePrinter
GetJobW
OpenPrinterW
userenv
UnloadUserProfile
winmm
PlaySoundW
timeEndPeriod
timeBeginPeriod
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 606KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ