e:\Documents and Settings\princ\Desktop\xTBot[1].0.0.2-priv\xTBot.0.0.2-priv\sdbot05b___Win32_Debug\rBot032.pdb
Static task
static1
Behavioral task
behavioral1
Sample
becaf1e159c35a740e02e9db9013a1d7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
becaf1e159c35a740e02e9db9013a1d7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
becaf1e159c35a740e02e9db9013a1d7_JaffaCakes118
-
Size
304KB
-
MD5
becaf1e159c35a740e02e9db9013a1d7
-
SHA1
990710904f7104be6da015f05ac93e0f31bc0fd7
-
SHA256
f7ef80c2251666dd6b98f8620896af371bedb29e458839de99d0e1f885abba16
-
SHA512
3f591729739b39a178bf647da533e48c2fa3284359518816d53769efe9e67f78f205cdecda66db1037f517beb112c67250fd3017fee29e9ac5428dc69f53f9e0
-
SSDEEP
6144:RyVv/mpcuYwFL3LomxKfmLnJt3+LF1P8:RyVBuYwFLrcudt3+T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource becaf1e159c35a740e02e9db9013a1d7_JaffaCakes118
Files
-
becaf1e159c35a740e02e9db9013a1d7_JaffaCakes118.exe windows:5 windows x86 arch:x86
ff784076c07aa08e1d9a598beae35484
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mpr
WNetAddConnection2A
WNetCancelConnection2A
ws2_32
ntohl
ioctlsocket
select
gethostbyaddr
inet_ntoa
getsockname
bind
WSAAsyncSelect
accept
__WSAFDIsSet
WSASocketA
setsockopt
htonl
sendto
WSAGetLastError
inet_addr
WSACleanup
WSAStartup
gethostbyname
htons
socket
connect
closesocket
send
recv
listen
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
kernel32
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
GetLocaleInfoW
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RaiseException
GetFileType
SetHandleCount
HeapReAlloc
CreateProcessA
CopyFileA
GetSystemDirectoryA
WriteConsoleW
GetLastError
CreateMutexA
GetTempPathA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
GetTimeFormatA
GetLocalTime
CreateThread
DeleteFileA
TerminateThread
ExpandEnvironmentStringsA
CloseHandle
WriteFile
CreateFileA
GetVersionExA
GlobalMemoryStatus
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
VirtualAlloc
VirtualFree
HeapDestroy
SetEndOfFile
GetProcessHeap
GetTimeZoneInformation
CompareStringA
CompareStringW
Sleep
SetEnvironmentVariableA
HeapCreate
IsValidCodePage
GetModuleHandleW
ExitProcess
HeapFree
HeapAlloc
GetCommandLineA
GetStartupInfoA
ReadFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetStdHandle
DeleteCriticalSection
FatalAppExitA
SetConsoleCtrlHandler
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
user32
SendMessageA
FindWindowA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
shell32
ShellExecuteA
Sections
.text Size: 255KB - Virtual size: 255KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ