C:\4TWGRS27YTG\QD3NKLFW08U9G.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bb04fcdf17a1427518cb05e16499f203_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
bb04fcdf17a1427518cb05e16499f203_JaffaCakes118
-
Size
94KB
-
MD5
bb04fcdf17a1427518cb05e16499f203
-
SHA1
4db75508c5aeef8fa75a9e592167004fc554c241
-
SHA256
b984318948a2f8d38b4c584d82455d64900ceac9359d3887e78c38f2d5b33b26
-
SHA512
d919d1676017ed0507e7ac3786566ed168196e5ddcbf3b585f727652abc217e1129b270c35279c558c0c3c7d5652efae6f0abc0ec1ff36a034c484dde5835175
-
SSDEEP
1536:Gdr52HNqvl8/y2TQYhgTLJyR30l4orIzAejYMwuDoYViGFJjv7FY5ANKqLghx:GLoNqvCjUG0ldMzfmvYBJjvpYDx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bb04fcdf17a1427518cb05e16499f203_JaffaCakes118
Files
-
bb04fcdf17a1427518cb05e16499f203_JaffaCakes118.exe windows:4 windows x86 arch:x86
921dac713ebcadc12cab814ba98ac0c3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
sendto
select
gethostname
kernel32
TlsSetValue
GetProcAddress
LoadLibraryA
HeapAlloc
HeapReAlloc
GetProcessHeap
CloseHandle
GetSystemInfo
ExitProcess
GetSystemTimeAsFileTime
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsAlloc
SetLastError
TlsFree
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
InterlockedExchange
VirtualQuery
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
VirtualAlloc
SetStdHandle
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
VirtualProtect
user32
wvsprintfA
wsprintfA
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ