d:\mydoc\Visual Studio Projects\loaderv62\Release\loaderv61.pdb
Behavioral task
behavioral1
Sample
ac8c878cc24e071cf8a61b3db2868c17_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
ac8c878cc24e071cf8a61b3db2868c17_JaffaCakes118
-
Size
96KB
-
MD5
ac8c878cc24e071cf8a61b3db2868c17
-
SHA1
0066d5b50729986a5e6cf6fd5e04606741aba3c9
-
SHA256
94dfc4026bbb2d59dc0e8372c37af988809eb288be8f11a35bc50f19b0d67733
-
SHA512
23d078a830c7e03017728b64abf7fe892f6a0e9a683f0356eb4cc95ff3077c31984a76d35372dbdad3829db4a8fa0c3d59678a8cd404d1afa07c36a83e6e6ff2
-
SSDEEP
1536:Ws0TMdgQz5Bz+fKyQK4u00Bf3B5l0lNVk2:Ws0odDFsVQT0ZLl0l
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac8c878cc24e071cf8a61b3db2868c17_JaffaCakes118
Files
-
ac8c878cc24e071cf8a61b3db2868c17_JaffaCakes118.exe windows:4 windows x86 arch:x86
68083aa7d9b499f2377be7fb4819f6ad
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
DeleteFileA
Sleep
MultiByteToWideChar
lstrlenA
WriteFile
CreateFileA
GetWindowsDirectoryA
WinExec
GetLastError
lstrcpyA
SetFilePointer
GetLocalTime
FindClose
SetFileTime
FindFirstFileA
GetFileSize
ReadFile
CopyFileA
CreateDirectoryA
GetEnvironmentVariableA
lstrcmpiA
VirtualProtect
GetLocaleInfoA
GetDateFormatA
LocalAlloc
lstrcatA
LocalFree
GetTimeFormatA
OpenProcess
VirtualAllocEx
WriteProcessMemory
CloseHandle
LoadLibraryA
GetProcAddress
CreateRemoteThread
FreeLibrary
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
GetModuleFileNameA
GetStringTypeW
GetStringTypeA
ExitProcess
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
RtlUnwind
InterlockedExchange
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
HeapSize
LCMapStringA
LCMapStringW
GetSystemInfo
user32
wsprintfA
advapi32
CreateServiceA
CryptEncrypt
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDestroyHash
CryptDecrypt
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ChangeServiceConfigA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
Sections
.UPX Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE