D:\WiDi-ver3.1-Production\bin\Win32\Release\SEStub.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bca4ae80a72f0115c89fbff897524479_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bca4ae80a72f0115c89fbff897524479_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bca4ae80a72f0115c89fbff897524479_JaffaCakes118
-
Size
314KB
-
MD5
bca4ae80a72f0115c89fbff897524479
-
SHA1
fef667420027fb86344a7aba78291cbf4035c9d8
-
SHA256
f4575f462aee09e3c8a1236517bc1f4531d344e8dea274c8b5a286f43ee9b20e
-
SHA512
5c21d5ad3bdbe59e359224cc61328b74f27110a2ac0388434562c8b2c8a24d583a4bd36712cb2623a3a0f41387b92db51db800f7c4c424bd0a020db6836ed103
-
SSDEEP
6144:8wjiNZfJawb90Y+auKuZOZMkpeLJTBJWQvG:sZJpyYTu0ZMkQLJTrbG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bca4ae80a72f0115c89fbff897524479_JaffaCakes118
Files
-
bca4ae80a72f0115c89fbff897524479_JaffaCakes118.exe windows:5 windows x86 arch:x86
f3258f72580b3ed89759c551c3b77a49
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
comctl32
InitCommonControlsEx
kernel32
MapViewOfFileEx
GetLastError
CreateFileMappingA
UnmapViewOfFile
SetFilePointer
GetFileSize
CreateFileA
GetFileAttributesA
ReadFile
WriteFile
SizeofResource
LockResource
LoadResource
FindResourceA
GetFileSizeEx
FlushFileBuffers
FindClose
DeleteFileA
RemoveDirectoryA
FindNextFileA
FindFirstFileA
SetFileTime
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetModuleFileNameA
GetFileTime
CreateMutexA
GetVersion
GetVersionExA
FreeLibrary
OutputDebugStringA
GetProcAddress
LoadLibraryA
GetSystemDefaultLangID
GetSystemDirectoryA
GetWindowsDirectoryA
SetCurrentDirectoryA
GetCommandLineA
Sleep
CreateThread
lstrlenA
CreateDirectoryA
GetTempFileNameA
GetTickCount
CompareStringW
CompareStringA
GetProcessHeap
SetEndOfFile
CreateFileW
GetTimeZoneInformation
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
CloseHandle
GetCurrentThreadId
InitializeCriticalSection
GetTempPathA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
GetStringTypeA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapFree
RtlUnwind
MoveFileA
GetModuleHandleW
ExitProcess
GetStartupInfoA
HeapAlloc
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
HeapCreate
HeapDestroy
VirtualFree
FatalAppExitA
VirtualAlloc
HeapReAlloc
SetHandleCount
GetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoA
SetEnvironmentVariableA
user32
wvsprintfA
SendMessageA
GetDlgItem
EnableWindow
LoadStringA
MessageBoxA
IsWindow
SetDlgItemTextA
CreateDialogParamA
GetMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
PostQuitMessage
SendDlgItemMessageA
advapi32
AllocateAndInitializeSid
RegQueryValueExA
RegOpenKeyExA
CheckTokenMembership
FreeSid
RegCloseKey
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 242KB - Virtual size: 241KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 361KB - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ