bthci.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b478cc3643586a9f848b645979a9f03d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b478cc3643586a9f848b645979a9f03d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b478cc3643586a9f848b645979a9f03d_JaffaCakes118
-
Size
40KB
-
MD5
b478cc3643586a9f848b645979a9f03d
-
SHA1
e468774df6d3c8f85b56f5401041f846c1dcf1e9
-
SHA256
7fa6f0778e076976108ba719c466ca0a5d5b46842fd9b0ca09d5a6412c4b9eac
-
SHA512
969f5f761c4b51969d5dfc8fdec5c20246679daaea0afd3563f48e5bb1a85616b666e1f062da0ae7171d1096370a8eb0a166ada08cb4b25c1bc1f2569a57b41d
-
SSDEEP
768:hH7w0wMuT+bAoJHWXOVAMbAHfcmQCRiuF09eie5iUt:h7J//bHpWXQAM0HfcmQW2eie5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b478cc3643586a9f848b645979a9f03d_JaffaCakes118
Files
-
b478cc3643586a9f848b645979a9f03d_JaffaCakes118.exe windows:5 windows x86 arch:x86
896bba561a0fea3b093b85ea950cdfac
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_except_handler3
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
_vsnwprintf
ntdll
VerSetConditionMask
setupapi
SetupCloseLog
SetupLogErrorW
SetupDiInstallDevice
SetupDiCreateDevRegKeyW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiSetClassInstallParamsW
SetupDiGetClassInstallParamsW
SetupOpenLog
user32
CharNextW
GetDlgItem
GetWindowTextW
IsWindowEnabled
SetWindowTextW
LoadStringW
SendMessageW
EnableWindow
ShowWindow
DialogBoxParamW
SetWindowLongW
GetWindowLongW
GetParent
advapi32
StartServiceW
ChangeServiceConfigW
QueryServiceConfigW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetKeySecurity
RegCloseKey
RegQueryValueExW
RegSetValueExW
CreateServiceW
kernel32
LoadLibraryA
QueryPerformanceCounter
VirtualAlloc
GetTickCount
GetCurrentThreadId
CreateFileW
CloseHandle
GetLastError
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
lstrcpynW
GetModuleFileNameW
LoadLibraryW
MultiByteToWideChar
GetStartupInfoA
lstrlenW
DisableThreadLibraryCalls
LocalFree
GetCommandLineW
VerifyVersionInfoW
SetLastError
OutputDebugStringW
WideCharToMultiByte
lstrcmpiW
InterlockedDecrement
LocalAlloc
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ