L:\owrLpbLTjKmm\SqPTlbPjLhdz\AsvmtCrNnPj\dxXjojBiJ\ywreanfmhOfioe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b09e7d4723feb64e1967b0b21e7848f9_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b09e7d4723feb64e1967b0b21e7848f9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b09e7d4723feb64e1967b0b21e7848f9_JaffaCakes118
-
Size
290KB
-
MD5
b09e7d4723feb64e1967b0b21e7848f9
-
SHA1
86c71d606225bb8f4601015221c90df22676f64c
-
SHA256
8634f29116a00ce4c8206c9c7ec3bde1324d2e597d0823f343203e4f52d7ab87
-
SHA512
c3427e665f6b863da592eb61d75727e9d77485985ccda6cc037ce445dad1ff7ba74a8c7bdf4f71d788296f67c5519b4c52cf33f3021fc1db371d8af399323c46
-
SSDEEP
6144:LZR//Ab6/AtdORzXDncR2IynUOOSSopNZFy5Ja:LZp/AbptUXDn9I0SixCa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b09e7d4723feb64e1967b0b21e7848f9_JaffaCakes118
Files
-
b09e7d4723feb64e1967b0b21e7848f9_JaffaCakes118.exe windows:5 windows x86 arch:x86
de8afe1017184a7292eaa8daedf5c201
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
GetActiveWindow
MoveWindow
GetMenuStringW
DrawTextA
IsCharUpperA
UpdateWindow
LoadBitmapW
DrawEdge
GetNextDlgTabItem
ChildWindowFromPoint
LoadStringA
CreateMenu
RegisterHotKey
DrawFrameControl
SetRectEmpty
CreateWindowExW
ValidateRect
KillTimer
MonitorFromPoint
SwitchToThisWindow
GetSubMenu
PostMessageA
LoadMenuA
AllowSetForegroundWindow
SendMessageTimeoutW
GetClientRect
RegisterClassA
wsprintfA
GetSystemMetrics
GetTopWindow
CharNextA
InSendMessageEx
LoadCursorA
GetScrollInfo
SystemParametersInfoA
TabbedTextOutW
IsZoomed
GetSystemMenu
SetWindowRgn
GetUserObjectInformationW
OpenIcon
GetDlgItemInt
GetWindow
shlwapi
StrToInt64ExA
ChrCmpIA
PathRemoveBlanksW
comdlg32
GetOpenFileNameA
ChooseColorW
kernel32
SetUnhandledExceptionFilter
CancelIo
CreateFileMappingW
SetLastError
GetCurrentThread
HeapReAlloc
WaitForMultipleObjectsEx
EnumResourceNamesW
ExitProcess
DeleteFileA
GetCommProperties
GetModuleHandleA
GetSystemDefaultLangID
FileTimeToLocalFileTime
GetModuleFileNameW
OpenFile
GlobalFree
VerSetConditionMask
TryEnterCriticalSection
GetHandleInformation
GetUserDefaultUILanguage
CreateMailslotW
msvcrt
_controlfp
__set_app_type
wcscmp
strncpy
wcstoul
__p__fmode
__p__commode
mktime
_amsg_exit
strcpy
strpbrk
_initterm
wcspbrk
_acmdln
swscanf
exit
clearerr
_ismbblead
_XcptFilter
_exit
_cexit
putc
time
__setusermatherr
__getmainargs
gdi32
SetDIBits
Polyline
CreatePalette
GetFontData
BeginPath
RoundRect
GetTextCharsetInfo
GetBkMode
SetBkMode
GetWindowOrgEx
GetCharWidth32W
SetROP2
GetStockObject
TextOutW
GetMapMode
PtVisible
GetObjectW
CreateHalftonePalette
Exports
Exports
?FreeMutantW@@YGDHMH~U
?PutPointerNew@@YGPAFPAJNKG~U
?DataW@@YGPAXFPAH~U
?CopyAppName@@YGJGGPAI~U
?InvalidateConfigExA@@YGPAFFGJ~U
?CrtThreadW@@YGPAKMPANPAE~U
?AddExpressionOld@@YGGPAHDE~U
?HideOptionNew@@YGXPAMMK~U
?ValidateProcessExA@@YGKDFDPAH~U
?CopyFilePathExA@@YGKN~U
?DeleteSizeA@@YGEIPAD~U
?ShowTaskA@@YGHDIPAD~U
?ShowKeyboardNew@@YGPAXEKH~U
?CrtProjectEx@@YGIPA_NM~U
?FindOptionExA@@YGPADMPAMH_N~U
?CloseDialog@@YGIHDPADPAI~U
?CopyOptionOriginal@@YGPAEIPAKHPAF~U
?TextOriginal@@YGFH~U
?LoadProcessA@@YGMFDPAI~U
?PutDeviceExW@@YGEPAEDHH~U
?IsValidWindowA@@YGMMPAJ~U
?IsValidFullNameA@@YGPAKJPAK~U
?KillDateEx@@YGNKPANPAII~U
?SendOptionExW@@YGFMK~U
?DecrementConfigA@@YGGPAKPAD~U
?SendAppNameOld@@YGXPAKHG~U
?IsValidMutantW@@YGPAXIKPA_ND~U
?FullNameA@@YGPAMJPAK~U
?InsertWindowInfoEx@@YGHEM~U
?ValidateConfigA@@YGDPAKD~U
?EnumClassExW@@YGHPAKPAJDPAG~U
?InsertSection@@YGPAFPAJK~U
?LoadNameOld@@YGPAH_N~U
?IsValidCharW@@YGFPAE~U
?FindProfileOld@@YGEDMMF~U
?LoadDateTimeOriginal@@YGPAIHPAIPAJ~U
?IsValidAnchorEx@@YGXJ~U
?RemoveOptionExW@@YGPANJPAJPAH~U
?FolderPathEx@@YGXPAIHG~U
?CopyProviderEx@@YGXPAJF~U
?InsertDirectoryNew@@YGKPAM~U
?WindowEx@@YGDII~U
?SendCharW@@YGPAI_NNPAG~U
?HideFunctionW@@YG_NME~U
?ValidateEventW@@YGFKIH~U
?IncrementWidthExA@@YGXFNPAH~U
?DateTimeA@@YGMJ~U
?KillTimeExA@@YGPANPAH~U
?InstallMutexW@@YGDJNID~U
?InsertMemoryW@@YGPANDPAGPAFI~U
?InsertListOld@@YGDPANHK~U
?DeleteSystemExA@@YGPAEPAK~U
?IsValidTimerExA@@YGJMPAKNM~U
?SendAnchorExA@@YGPAEPAEI~U
?OnAppNameA@@YGFIPAFM~U
?InstallConfigNew@@YGDPAD~U
?FreeSemaphoreEx@@YGHMIPAK~U
?CloseFilePathOriginal@@YGMPAMHPAG~U
?GenerateHeightEx@@YGXPAH~U
?CallConfigW@@YGPAHMPAM~U
?VersionOriginal@@YGKFPA_N~U
?RemoveStringExA@@YG_ND~U
?CallWidthA@@YGMPAMPAIE_N~U
?CopyText@@YGPAIPAG~U
?GetWindowInfo@@YGDKFPA_N~U
?InsertKeyNameOld@@YGPAHE~U
?ModifyFolderExW@@YGKIJPAG~U
?GetOptionExA@@YGPAIPAGD~U
?CancelVersionExW@@YGDH_NK~U
?CancelFunctionOld@@YGPAHM~U
?ShowAnchorW@@YGIKMKE~U
?AddWindowInfoW@@YGPADPAG~U
?DecrementListA@@YGKE~U
?FormatData@@YGPAKPAHMPAIPAJ~U
?DecrementPointerW@@YGPAXPAH~U
?OnModuleExW@@YGXIK~U
?RtlWindowExW@@YGEIFE~U
?Data@@YGXNKPAE_N~U
?KillSemaphoreExW@@YGKF_NIH~U
?CopyMediaTypeW@@YGIDEG~U
?LoadKeyNameA@@YGJGJI~U
?ValidateValueExA@@YGEDEPAG~U
?InvalidateDeviceW@@YGJG~U
?CloseWindowInfoNew@@YGPAFF_NGG~U
?RtlCommandLineA@@YGPANKPAM~U
?AddHeaderNew@@YGJGPAE_NH~U
?IsNotThreadExW@@YGMF~U
?PutDialogW@@YGXPAKPAJPAHPAH~U
?CopyTaskW@@YGFEJM~U
?LoadSectionNew@@YGMPAN~U
?ModifyMonitorW@@YGPAMG~U
?GetWindowA@@YGPA_NNM~U
?CopyComponentExW@@YGPAHJ~U
?InsertValueOriginal@@YGFPAJHD~U
?EnumWindowEx@@YGXPAHK~U
?EnumCommandLineExA@@YG_NPAMI~U
?InsertComponentOld@@YGJPAGNPAD~U
?FormatProcessOld@@YG_NKH~U
?CancelMemory@@YGKFPAHPAJI~U
?GlobalWindowExW@@YGGPAGPAKDE~U
?AddThreadEx@@YGXPAGPAG~U
?CallHeight@@YGGDM~U
?AddSizeNew@@YGFKPAH~U
?CloseExpressionOld@@YGHM~U
?CrtAnchorW@@YGJPAGMPAKPAH~U
?CallKeyNameExW@@YGPAJPA_N~U
?InvalidateMediaTypeOriginal@@YGFKD~U
?SendDateTimeNew@@YGENPA_N~U
?CrtAnchorOld@@YGPAMKK~U
?CopyVersionA@@YGEJ~U
?ConfigOld@@YGPAINIM~U
?FindFilePath@@YGPAGPAIMPAFPAE~U
?IncrementThreadNew@@YGPAGPAEPAFG~U
?InsertMainStructDlhSi@@YGKGH@Z
?ShowFunctionOriginal@@YGEPAHD~U
?SendCharA@@YGPAKPAGPAMM~U
?WindowOriginal@@YGKGH~U
?FindSystemW@@YGEPANG~U
?IsPointEx@@YGKEPAIJPAH~U
?CopyMemoryOld@@YGGPAKNHH~U
?IsNotProjectEx@@YGXJ~U
?ValidateMutantExA@@YGPAGMH~U
?RemoveKeyboardNew@@YGPAFPAH~U
?ModifySize@@YGPAGGPAFK~U
?GlobalSemaphoreExA@@YGXPAG~U
?ValidateTimeNew@@YGPAXMPAHKPAJ~U
?CloseTimeExA@@YGJ_NGFG~U
?CloseProfile@@YGPAXIMDPAJ~U
?RemoveTaskNew@@YGHI_NH~U
?GetPenW@@YGF_NJJ~U
?IncrementDialogNew@@YGPANPAIK~U
?FreeDateEx@@YGGPAEH~U
?KillArgumentNew@@YGPAEK~U
?MutantOriginal@@YGPAXE~U
?GenerateCharW@@YGHJPAK~U
?IsValidCommandLineW@@YG_NPAM~U
?PutDialogNew@@YGXIKGPAG~U
?SendArgumentExW@@YGPAMKPANM~U
?InstallCommandLineW@@YGEFEPAID~U
?ShowWidthEx@@YGXIPAHPAMPAI~U
?HideDirectoryA@@YGFH~U
?ValidateRectA@@YGJKG~U
?GenerateMonitorOld@@YGDIEE~U
?FreeObjectW@@YGXPAM~U
?RemoveSystemExW@@YGGPAHPANM~U
?GenerateFunctionOld@@YGXF~U
?ProfileExW@@YG_NM~U
?GetMutexW@@YGPAMFMJG~U
?InsertPointW@@YGPADPAHDDPAD~U
?CallPointerOld@@YGNPANPAH~U
?CallPenExA@@YGXN_N~U
?FreeModuleExA@@YGXMJD~U
?CallPath@@YGJEMPA_N~U
?KillCommandLineNew@@YGPAGIKPADG~U
?CopySizeExA@@YGHE~U
?InstallModuleExA@@YGPADEPAEPAFE~U
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rimp Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdbg1 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.redt Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rit Size: 512B - Virtual size: 508B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdbg2 Size: 512B - Virtual size: 94B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rvar Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rpt Size: 1024B - Virtual size: 603B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hdata Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ping Size: - Virtual size: 455KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 252KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ