explorer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b11cdaef763c2b3735749375c87da51b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b11cdaef763c2b3735749375c87da51b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b11cdaef763c2b3735749375c87da51b_JaffaCakes118
-
Size
2.7MB
-
MD5
b11cdaef763c2b3735749375c87da51b
-
SHA1
78f4d1c827de75d2f5841776c17c4a762ecbf471
-
SHA256
6ad07f6615e9de8713b14fb4e12c95960fa24731a94a6e1e540e4f354e842b25
-
SHA512
4716ab71c7a85d32f2dd9ab199bbd988b45141af23ca32477e643819b3811e97902a532c00474a3d1d4d612a0e4ec4f7b700b0b5a8c1db39919c2c3e8e2c7236
-
SSDEEP
49152:dn4AcISFxQx5PxlPtBC6ga7vYYYYYYYYYYYRYYYYYYYYYYE3iA7/eFUJN9ojoso6:d4ATJVvYYYYYYYYYYYRYYYYYYYYYYE3O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b11cdaef763c2b3735749375c87da51b_JaffaCakes118
Files
-
b11cdaef763c2b3735749375c87da51b_JaffaCakes118.exe windows:6 windows x64 arch:x64
a66a9ff5af16de7327a6627f119d2939
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
RegCreateKeyW
RegCloseKey
RegOpenKeyExW
RegGetValueW
EventWrite
EventEnabled
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryValueExW
GetLengthSid
GetTokenInformation
OpenProcessToken
RegCreateKeyExW
RegSetValueExW
EventRegister
EventUnregister
TraceMessage
RegOpenKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumValueW
LsaOpenPolicy
GetSidSubAuthorityCount
LsaClose
IsValidSid
LsaFreeMemory
StartTraceW
EnableTraceEx
StopTraceW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
StartServiceW
CreateWellKnownSid
RegEnumKeyExW
GetSidSubAuthority
LsaLookupSids
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CheckTokenMembership
QueryServiceStatus
OpenSCManagerW
OpenServiceW
CloseServiceHandle
ConvertStringSidToSidW
OpenThreadToken
kernel32
DelayLoadFailureHook
LoadLibraryExA
ReadFile
GetFileSize
CreateFileW
FlushInstructionCache
RaiseException
SetLastError
OpenThread
GetSystemTimeAsFileTime
GetLocaleInfoW
GetDateFormatW
GetTimeFormatW
GetLocalTime
MultiByteToWideChar
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
OpenEventW
InterlockedPopEntrySList
FindClose
FindNextFileW
GetLongPathNameW
SetProcessShutdownParameters
GetStartupInfoW
ReleaseMutex
CreateMutexW
InitializeCriticalSection
DeleteCriticalSection
VirtualAlloc
InterlockedPushEntrySList
SetUnhandledExceptionFilter
QueryPerformanceCounter
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VirtualFree
lstrcmpiW
CompareStringOrdinal
FindFirstFileW
SetErrorMode
CreateEventW
GetSystemDirectoryW
GetVersionExW
FreeLibrary
GetProcAddress
LoadLibraryW
GetUserDefaultUILanguage
WaitForSingleObject
SetTermsrvAppInstallMode
GetFileAttributesW
RegisterApplicationRestart
GlobalGetAtomNameW
ExpandEnvironmentStringsW
SystemTimeToFileTime
GetSystemTime
MulDiv
GetTickCount64
GetThreadPriority
LeaveCriticalSection
EnterCriticalSection
SetEvent
GetCurrentThread
SetThreadPriority
GetTickCount
GetUserDefaultLangID
ExitProcess
HeapDestroy
UnmapViewOfFile
MapViewOfFile
SearchPathW
GetDynamicTimeZoneInformation
GetTimeZoneInformation
GetBinaryTypeW
QueryPerformanceFrequency
QueueUserWorkItem
LoadLibraryExW
GetProductInfo
TerminateThread
CreateIoCompletionPort
GetQueuedCompletionStatus
LoadLibraryA
DeleteFileW
GetProcessId
GetModuleHandleA
GetWindowsDirectoryW
CompareStringW
lstrcmpA
CompareFileTime
QueryFullProcessImageNameW
CreateFileMappingW
ResetEvent
WideCharToMultiByte
GlobalFree
DuplicateHandle
GetCurrentDirectoryW
WaitForMultipleObjects
GetComputerNameW
GlobalLock
GlobalUnlock
GlobalAlloc
lstrlenA
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
LockResource
LoadResource
FindResourceExW
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
GetCommandLineW
GetPrivateProfileStringW
GetModuleFileNameW
CreateProcessW
lstrlenW
OpenProcess
LocalFree
LocalAlloc
QueryInformationJobObject
Sleep
CreateThread
SetPriorityClass
GetPriorityClass
ResumeThread
AssignProcessToJobObject
SetInformationJobObject
GetLastError
CreateJobObjectW
CloseHandle
gdi32
LPtoDP
GetRgnBox
OffsetViewportOrgEx
GetStockObject
GdiFlush
CombineRgn
OffsetRgn
SetLayout
SetWindowOrgEx
StretchBlt
GetTextExtentPoint32W
CreatePen
Polyline
GetRegionData
GetTextColor
GetLayout
GetTextMetricsW
ExtCreateRegion
SetDIBits
SelectClipRgn
SetViewportOrgEx
GetViewportOrgEx
IntersectClipRect
GetClipRgn
CreateRectRgn
GetBkColor
PatBlt
CreateBitmap
SetBkMode
SetTextColor
SetBkColor
OffsetWindowOrgEx
CreateCompatibleBitmap
GetTextExtentPointW
GetClipBox
GetObjectW
GdiAlphaBlend
BitBlt
GetDeviceCaps
CreateFontIndirectW
CreateRectRgnIndirect
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
ExtTextOutW
user32
CopyRect
SetRect
CreateWindowExW
DialogBoxParamW
GetClassInfoW
GetClassInfoExW
GetMenuItemInfoW
GetMenuItemCount
DefWindowProcW
ActivateKeyboardLayout
GetCursorPos
InsertMenuW
GetMenuStringW
SetMenuItemInfoW
InsertMenuItemW
IsChild
IsWinEventHookInstalled
IsProcessDPIAware
IsRectEmpty
UnionRect
GetClassLongW
SetClassLongW
GetGUIThreadInfo
GetDlgCtrlID
GetNextDlgGroupItem
GetNextDlgTabItem
MoveWindow
ChildWindowFromPointEx
GetWindowDC
CharUpperW
UnregisterClassW
FrameRect
WindowFromDC
SendMessageCallbackW
UpdateLayeredWindow
GetUserObjectInformationW
GetProcessWindowStation
GetThreadDesktop
ShowWindowAsync
BringWindowToTop
GetClassLongPtrW
GetIconInfo
RegisterShellHookWindow
DeregisterShellHookWindow
FlashWindowEx
SetThreadDesktop
EndTask
OpenInputDesktop
CloseDesktop
GetMenuState
IsZoomed
SetScrollInfo
GetScrollInfo
SetScrollPos
InternalGetWindowText
GetWindowInfo
GetCaretBlinkTime
SetLayeredWindowAttributes
GetLayeredWindowAttributes
GetUpdateRect
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetFocus
GetAncestor
ReleaseCapture
GetDoubleClickTime
RegisterWindowMessageW
SetWindowTextW
SetWindowPlacement
SetRectEmpty
EnumDisplayMonitors
InflateRect
EqualRect
UpdateWindow
GetMonitorInfoW
MonitorFromPoint
MonitorFromRect
CharPrevW
GetMessageW
TranslateMessage
DispatchMessageW
CreatePopupMenu
GetMenuDefaultItem
SendNotifyMessageW
LockSetForegroundWindow
ChangeWindowMessageFilterEx
IntersectRect
MonitorFromWindow
IsWindowVisible
GetForegroundWindow
EnumWindows
GetParent
IsWindow
TranslateAcceleratorW
WaitMessage
GetWindowTextW
GetClientRect
TrackPopupMenuEx
SetActiveWindow
GetKeyState
GhostWindowFromHungWindow
RegisterClassW
LoadCursorW
SubtractRect
RedrawWindow
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
InvalidateRect
OffsetRect
SendMessageTimeoutW
SetWindowRgn
UpdateLayeredWindowIndirect
GetWindowRgnBox
LoadImageW
GetWindowPlacement
SetForegroundWindow
GetLastInputInfo
RemovePropW
GetLastActivePopup
SwitchToThisWindow
MessageBeep
GetActiveWindow
GetFocus
SetCursor
UnregisterHotKey
RegisterHotKey
SendDlgItemMessageW
EndDialog
GetDesktopWindow
GetAsyncKeyState
ChildWindowFromPoint
SetCursorPos
GetMessagePos
BeginPaint
FillRect
DrawEdge
EndPaint
GetSystemMenu
EnableMenuItem
ExitWindowsEx
LoadIconW
DestroyIcon
IsIconic
DeleteMenu
CheckMenuItem
ModifyMenuW
WindowFromPoint
ClientToScreen
TrackPopupMenu
IsHungAppWindow
GetWindowThreadProcessId
AppendMenuW
CascadeWindows
TileWindows
LockWorkStation
ScreenToClient
RegisterClipboardFormatW
NotifyWinEvent
GetSysColor
DrawFocusRect
AdjustWindowRectEx
CopyIcon
MsgWaitForMultipleObjects
SetWinEventHook
RegisterClassExW
GetDlgItem
EnableWindow
GetDlgItemInt
SetDlgItemInt
IsDlgButtonChecked
IsWindowEnabled
CheckDlgButton
CallWindowProcW
SetCapture
DrawTextW
AdjustWindowRect
CalculatePopupWindowPosition
GetMessageExtraInfo
GetCapture
SetGestureConfig
DrawIconEx
RemoveMenu
SetMenuDefaultItem
LoadMenuW
GetSubMenu
AllowSetForegroundWindow
LoadAcceleratorsW
TrackMouseEvent
CharNextW
GetWindow
GetSysColorBrush
GetPropW
HungWindowFromGhostWindow
SetWindowCompositionAttribute
GetWindowLongW
MsgWaitForMultipleObjectsEx
EnumChildWindows
SendMessageW
PtInRect
GetKeyboardLayout
GetWindowRect
DestroyMenu
SystemParametersInfoW
ShowWindow
MapWindowPoints
SetTimer
SetPropW
KillTimer
SetWindowPos
GetWindowLongPtrW
PostQuitMessage
SetWindowLongPtrW
DestroyWindow
ShutdownBlockReasonCreate
LoadStringW
PostMessageW
PeekMessageW
ReleaseDC
GetDC
FindWindowW
GetSystemMetrics
GetShellWindow
GetClassNameW
msvcrt
_vsnwprintf
free
wcsstr
iswalpha
wcschr
realloc
_wcsicmp
cosf
_wtoi
memcmp
sqrt
ceil
bsearch
__wgetmainargs
__C_specific_handler
_XcptFilter
_exit
_cexit
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
_commode
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
memmove
memcpy
memset
_fmode
malloc
sin
ntdll
WinSqmSetString
WinSqmSetDWORD
WinSqmAddToStreamEx
NtSetSystemInformation
WinSqmAddToStream
WinSqmEventEnabled
WinSqmIsOptedIn
NtSetInformationProcess
NtQueryInformationToken
NtOpenProcessToken
NtClose
NtOpenThreadToken
RtlGetProductInfo
EtwEventEnabled
EtwEventWrite
NtQueryInformationProcess
shlwapi
StrStrIW
ord219
ord467
AssocQueryStringW
PathQuoteSpacesW
ord433
SHDeleteKeyW
ord560
ord24
SHRegGetUSValueW
ord548
ord630
ord212
ord184
ord164
ord175
ord559
PathIsNetworkPathW
ord213
SHOpenRegStream2W
ord631
SHRegGetBoolUSValueW
ord172
SHStrDupW
StrChrIW
ord413
ord478
ord460
PathFileExistsW
PathGetDriveNumberW
ord204
ord165
ord197
ord157
ord292
PathRemoveFileSpecW
PathIsDirectoryW
ord199
ord176
SHRegGetValueW
ord270
ChrCmpIW
ord510
AssocQueryKeyW
PathStripPathW
ord509
PathIsRootW
ord156
PathParseIconLocationW
StrCmpIW
ord437
StrCmpW
PathIsPrefixW
ord571
ord225
ord237
ord177
ord178
ord484
SHCreateStreamOnFileW
SHQueryInfoKeyW
StrCmpNW
StrTrimW
ord12
ord168
ord256
PathStripToRootW
StrRetToBufW
PathCommonPrefixW
ord479
ord503
ord502
ord236
SHStrDupA
ord154
PathRemoveExtensionW
ord487
PathIsFileSpecW
ord439
ord215
AssocCreate
ord632
ord476
ord217
StrRetToStrW
StrToIntW
StrChrW
ord8
ord9
ord158
PathCombineW
ord10
SHCreateThreadRef
SHSetThreadRef
ord174
SHGetValueW
PathFindFileNameW
PathRemoveArgsW
PathRemoveBlanksW
StrCmpNIW
PathGetArgsW
ord635
ord618
SHSetValueW
SHDeleteValueW
PathAppendW
ord16
ord278
ord240
ord629
ord193
ord163
PathFindExtensionW
ord279
ord388
shell32
ord814
ord885
ord165
SHCreateDataObject
SHGetLocalizedName
ord787
ord790
ord193
ord88
ord154
ord840
Shell_GetCachedImageIndexW
ord74
ord818
ord902
ord895
ord6
ord241
SHGetStockIconInfo
ord265
ord181
SHGetPropertyStoreForWindow
ord894
ord162
ord152
ord95
ord850
ord23
SHGetSpecialFolderLocation
SHCreateItemWithParent
SHBindToFolderIDListParent
SHBindToFolderIDListParentEx
ord28
SHChangeNotify
ord747
ord727
SHGetFileInfoW
ord100
ord85
ord18
SHParseDisplayName
ord155
ord190
SHGetFolderLocation
ord176
SHGetSpecialFolderPathW
SHBindToObject
ord89
ord245
ord200
ord723
ord68
ord680
SHGetKnownFolderIDList
ShellExecuteExW
ord899
ord188
ord660
ord201
SHGetNameFromIDList
ord892
SHCreateShellItem
ord67
ord17
ord2
ord711
SHChangeNotifyRegisterThread
ord19
ord16
ord25
ord21
ord137
ord733
ord753
ord644
ord645
ord4
SHGetPathFromIDListW
ord731
ord244
SHFileOperationW
SHGetFolderPathEx
SHUpdateRecycleBinIcon
ord60
ord896
ord64
ord61
SHBindToParent
SHGetFolderPathW
SHGetPathFromIDListA
ShellExecuteW
SHEnableServiceObject
ord54
ord254
ord91
ord132
SHGetIDListFromObject
ord886
SHCreateItemFromIDList
ord893
SHAddToRecentDocs
Shell_NotifyIconW
Shell_NotifyIconGetRect
ExtractIconExW
SHEvaluateSystemCommandTemplate
ord102
SHCreateShellItemArrayFromIDLists
ord22
ord134
DragQueryFileW
SHGetKnownFolderPath
SHCreateShellItemArrayFromShellItem
SHCreateItemFromParsingName
ord849
ole32
CoInitializeEx
CLSIDFromString
CoGetMalloc
CoGetInterfaceAndReleaseStream
RevokeDragDrop
RegisterDragDrop
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoFreeUnusedLibraries
CoRegisterMessageFilter
StringFromGUID2
OleUninitialize
OleInitialize
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
CoTaskMemFree
CreateStreamOnHGlobal
ReleaseStgMedium
PropVariantClear
CreateBindCtx
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
oleaut32
VariantInit
VariantClear
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
explorerframe
ord110
ord111
uxtheme
GetThemeBackgroundExtent
GetThemeBackgroundRegion
GetThemeColor
IsThemePartDefined
GetThemeRect
DrawThemeIcon
GetBufferedPaintBits
BufferedPaintClear
IsAppThemed
IsCompositionActive
OpenThemeData
CloseThemeData
SetWindowTheme
GetThemeMetric
DrawThemeBackground
GetThemeTextExtent
DrawThemeText
GetThemeBool
DrawThemeParentBackground
GetWindowTheme
GetThemeBackgroundContentRect
GetThemePartSize
BeginBufferedPaint
DrawThemeTextEx
EndBufferedPaint
GetThemeMargins
BufferedPaintInit
BufferedPaintUnInit
IsThemeActive
ord86
powrprof
CallNtPowerInformation
PowerDeterminePlatformRole
GetPwrCapabilities
dwmapi
ord105
ord113
DwmEnableBlurBehindWindow
DwmSetWindowAttribute
DwmIsCompositionEnabled
DwmQueryThumbnailSourceSize
ord124
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail
ord114
ord127
slc
SLGetWindowsInformationDWORD
gdiplus
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipFree
GdipAlloc
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetCompositingMode
secur32
GetUserNameExW
rpcrt4
NdrClientCall3
I_RpcExceptionFilter
RpcStringFreeW
RpcBindingFree
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
propsys
PSCreateMemoryPropertyStore
VariantToStringAlloc
VariantToStringWithDefault
PropVariantToString
VariantToBooleanWithDefault
PropVariantToInt64
VariantToInt32WithDefault
PropVariantToBoolean
PropVariantToUInt64
PropVariantToUInt32
PropVariantToStringAlloc
Sections
.text Size: 734KB - Virtual size: 734KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 187KB - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ