netstat.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b8f0a3fc288f35b4bac4d651b6fca526_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b8f0a3fc288f35b4bac4d651b6fca526_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b8f0a3fc288f35b4bac4d651b6fca526_JaffaCakes118
-
Size
180KB
-
MD5
b8f0a3fc288f35b4bac4d651b6fca526
-
SHA1
4aad6d65d789e5bff423a7203f8c1dcccb930505
-
SHA256
f0f1aafdc171b85a27daaa7b997ff395a828e973f759a060fcabfe3a65e128d5
-
SHA512
31ece9cd1de093c332f9adf4bd05180d434a5116725cd395425d5e11380bf3dc26f4f2808c22082e72c67a82684fb9808ba65171bc714264643becb31c07d93e
-
SSDEEP
3072:avXi+LtYWnBfpBFssrW/VmVy1aoBmJ4Y7MDPHmG0feSzM5X3rTyUUUzIioL:avXiOBfpBOdOgMlzM5X3ruDig
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8f0a3fc288f35b4bac4d651b6fca526_JaffaCakes118
Files
-
b8f0a3fc288f35b4bac4d651b6fca526_JaffaCakes118.exe windows:5 windows x86 arch:x86
9b2e0e6048c9be88c7fb33585f4e1f8a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_iob
exit
toupper
sscanf
_strupr
_c_exit
_exit
_XcptFilter
_cexit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
sprintf
_except_handler3
_controlfp
time
fprintf
strchr
_setmode
system
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
kernel32
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CloseHandle
LoadLibraryA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
LoadLibraryExA
Sleep
FreeLibrary
HeapFree
GetProcessHeap
OpenProcess
lstrcmpiA
GetProcAddress
GetCurrentProcess
GetSystemTimeAsFileTime
TerminateProcess
GetLastError
GetSystemDirectoryA
LocalFree
FormatMessageA
dbghelp
SymInitialize
SymSetSearchPath
SymLoadModuleEx
SymGetModuleInfo64
SymCleanup
psapi
EnumProcessModules
GetModuleInformation
GetModuleBaseNameA
GetModuleFileNameExA
iphlpapi
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
GetIcmpStatsFromStackEx
GetUdpStatsFromStackEx
AllocateAndGetUdpExTable2FromStack
GetIpStatsFromStackEx
AllocateAndGetTcpExTable2FromStack
GetTcpStatsFromStackEx
user32
CharToOemBuffA
ws2_32
htons
getnameinfo
gethostname
ntohl
ntohs
WSAStartup
ntdll
RtlAllocateHeap
RtlFreeHeap
NtQuerySystemInformation
snmpapi
SnmpUtilVarBindFree
SnmpUtilMemFree
SnmpUtilMemAlloc
SnmpUtilOidCpy
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PACK Size: 144KB - Virtual size: 380KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE