VsJITDebugger.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bdcd3b8ea34879b21ccaa4f6b2db38ac_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bdcd3b8ea34879b21ccaa4f6b2db38ac_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bdcd3b8ea34879b21ccaa4f6b2db38ac_JaffaCakes118
-
Size
230KB
-
MD5
bdcd3b8ea34879b21ccaa4f6b2db38ac
-
SHA1
84b1958fcdf444a90496de988eaaed77f89fa97b
-
SHA256
5350df6e828ac8bc78760500e6f9a0c20ac12beb5770f95a07a400fb98dc698d
-
SHA512
a54697ba5163e9096e527528eb132a31647a75618cca7cc34d31efe04e1c2417ff63a6ef3137cc972688cead26cc3e08280a981b659e2dada8c7913c2dbd837a
-
SSDEEP
3072:aN00WgdMm+8P/d3lUjIHwOPZB60C/fVpSz2SLyit2o3y5+xqwjbXit2YF8dJsQmT:XkdN+8HBG0Ugoii8AbNOqc837eqziKz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bdcd3b8ea34879b21ccaa4f6b2db38ac_JaffaCakes118
Files
-
bdcd3b8ea34879b21ccaa4f6b2db38ac_JaffaCakes118.exe windows:5 windows x86 arch:x86
3b5e54a80a23a84cd9c572c74b96bb88
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenProcessToken
GetTokenInformation
EqualSid
PrivilegeCheck
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
OpenThreadToken
kernel32
OpenProcess
InterlockedIncrement
InterlockedDecrement
SetEvent
InterlockedCompareExchange
InterlockedExchange
GetCurrentProcess
FlushInstructionCache
SetLastError
RaiseException
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
OpenEventW
SetUnhandledExceptionFilter
GetCommandLineW
DuplicateHandle
CreateThread
OpenFileMappingW
FreeLibrary
lstrcmpiW
MultiByteToWideChar
LoadLibraryExW
GetThreadLocale
InitializeCriticalSection
FindResourceW
SizeofResource
LoadResource
DeleteCriticalSection
GetPrivateProfileStringW
HeapFree
HeapReAlloc
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
GetStartupInfoA
UnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentProcessId
GetCurrentThread
HeapSize
ExitProcess
GetTickCount
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
RtlUnwind
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
CompareStringW
IsProcessorFeaturePresent
TlsFree
Sleep
LocalAlloc
CreateMutexW
ReleaseMutex
FindFirstFileW
FindClose
GetVersionExW
FormatMessageW
FormatMessageA
LocalFree
LockResource
LoadLibraryW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetVersion
GetLastError
ContinueDebugEvent
SuspendThread
WaitForDebugEvent
lstrlenW
CreateProcessW
GetModuleHandleW
GetProcAddress
GetFileAttributesW
MapViewOfFile
CreateFileMappingW
CreateFileW
SearchPathW
UnmapViewOfFile
WaitForSingleObject
WaitForMultipleObjects
ResumeThread
WriteProcessMemory
ReadProcessMemory
CreateEventW
GetStartupInfoW
GetModuleFileNameW
TerminateProcess
CloseHandle
WriteFile
gdi32
GetTextExtentPoint32W
user32
GetDlgItem
GetProcessWindowStation
GetUserObjectInformationW
LoadStringW
EnumWindows
GetWindowThreadProcessId
IsWindowVisible
MessageBoxW
SetForegroundWindow
UnregisterClassA
CharNextW
SetWindowLongW
SendMessageW
EndDialog
SetWindowPos
GetWindowLongW
EnableWindow
GetWindowTextW
IsDlgButtonChecked
CheckDlgButton
GetDC
DialogBoxParamW
SetDlgItemTextW
GetWindow
SystemParametersInfoW
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
ole32
CreateStreamOnHGlobal
StringFromGUID2
CLSIDFromString
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
CoDisconnectObject
CoUnmarshalInterface
CoTaskMemRealloc
CoGetCallContext
CoRevertToSelf
CoImpersonateClient
CoTaskMemAlloc
CoSetProxyBlanket
CoQueryProxyBlanket
oleaut32
SysAllocString
SysStringLen
VarBstrCat
VarUI4FromStr
SysAllocStringLen
SysFreeString
shell32
SHGetFolderPathW
rpcrt4
NdrClientCall2
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingSetAuthInfoW
Sections
.text Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE