h:\Builds\SVN\NICAgents\CPQNIMGT_32\W2KMGTSV\x64\Release\cpqnimgt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
aa5faa049c93871b67283355a9acc401_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
aa5faa049c93871b67283355a9acc401_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
aa5faa049c93871b67283355a9acc401_JaffaCakes118
-
Size
9KB
-
MD5
aa5faa049c93871b67283355a9acc401
-
SHA1
13a6408d5b336f48da7f16c03ac0758bb1f14e0d
-
SHA256
1ab3d22097fbfc9c63890d636c5f8fce86f90ccdd282be7c4cf302866e67b94c
-
SHA512
9a6612461fee1d4f302f0329057d0bea0ff49c303b5736c5cec8334e4d9705f1cb389433650be9b142e01cdffef0e78ef5c1dc42f98ebb5da5186618951813b9
-
SSDEEP
96:sEehGPeZ6oxz89PIdgoTLThDwoj6d1QmgsPQbJxupJMtm98NDkvC7tE:sEehvZ6n9PazrhDeW8PQDupJN4k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa5faa049c93871b67283355a9acc401_JaffaCakes118
Files
-
aa5faa049c93871b67283355a9acc401_JaffaCakes118.exe windows:5 windows x64 arch:x64
d09d2ef02af93e213e6fefaa065fc714
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
GetSystemTimeAsFileTime
user32
wsprintfA
msvcr90
__setusermatherr
_commode
_fmode
_encode_pointer
_configthreadlocale
__crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_initterm_e
_initterm
__initenv
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__getmainargs
_amsg_exit
memset
__set_app_type
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ