I:\JMyMunrCzkbroXyyphKd\XwtylpyNOgl\hOcsFRnFbtaZg\rtbbrKWguwyskPShgTx\gcdxZwcRMska\KgkPxbcKqCjfltd\VwcjpvbfLZUqgEPv\xvdoknkdxHpu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c209fb8f5b2d327471b37f7353b596ce_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c209fb8f5b2d327471b37f7353b596ce_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c209fb8f5b2d327471b37f7353b596ce_JaffaCakes118
-
Size
143KB
-
MD5
c209fb8f5b2d327471b37f7353b596ce
-
SHA1
49f91f299c9c4cc7805c63ad6c1d4cefe1bf27cc
-
SHA256
ad5f863422bb86d71dc1282d768264f471c8d080376038cca11324adcfa0d1d7
-
SHA512
fdf59bcd31c64331e0e811655ec334cee52ce8d18492889fe550b74d00065d46e6ca53782ab92f9df6362e44235f17ae66b401c5c6efaf3ba391419ceff8d511
-
SSDEEP
3072:to8G4dsEZUrcZFZc1uVRg05grDDUhDQU/fN9yyDI8d:tBUrKFV5SU1Pbt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c209fb8f5b2d327471b37f7353b596ce_JaffaCakes118
Files
-
c209fb8f5b2d327471b37f7353b596ce_JaffaCakes118.exe windows:5 windows x86 arch:x86
c3d2aceeb0a3a3a11b8122506b4bb612
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
IsWindowUnicode
BeginDeferWindowPos
RegisterClassExW
CheckMenuRadioItem
InsertMenuW
IsCharLowerA
LoadStringW
EnableWindow
DialogBoxIndirectParamA
GetWindowRect
GetMenuCheckMarkDimensions
GetClassInfoW
MapVirtualKeyW
WaitMessage
OpenDesktopW
GetClassInfoExW
GetMenuItemInfoW
SetWindowPos
TranslateMessage
SetClassLongW
IsDialogMessageA
CreatePopupMenu
GetSystemMetrics
DispatchMessageA
IsChild
FindWindowA
CharPrevA
UnloadKeyboardLayout
comctl32
CreateStatusWindowW
ImageList_Draw
ImageList_GetImageCount
CreatePropertySheetPageW
CreatePropertySheetPageA
gdi32
StretchBlt
Polyline
GetCurrentObject
GetNearestPaletteIndex
GetViewportOrgEx
CreatePen
OffsetRgn
CreateRoundRectRgn
Escape
GetCharWidth32W
SetLayout
GetRgnBox
shlwapi
StrFormatByteSizeA
ChrCmpIA
PathSearchAndQualifyA
StrToIntA
kernel32
GetHandleInformation
HeapAlloc
ReadFile
GetCommModemStatus
GetCommTimeouts
WaitForSingleObjectEx
EnumResourceTypesA
lstrcmpiW
SuspendThread
lstrlenW
SetCommState
LockFile
DuplicateHandle
SetNamedPipeHandleState
GetModuleFileNameW
GetCommandLineA
GetProcessHeap
Exports
Exports
?eXEUW_HGVKkejgiiknVl@@YGEPAF@Z
?_fhegfd_h_ySP_RUg_eI_@@YG_NPAHH@Z
?_U_ZJO_MCT_JWVJBLOBB_@@YGXD@Z
?hvtcyyyke__@@YGFPAD@Z
?_Y_CJSC@@YGFI@Z
?blijfppfitXVXgWHFNM_@@YGMN@Z
?EZGZE_NYBHSH___CJ_mjxn@@YGPAXG@Z
?__uyy__@@YGJPAM@Z
?D__ZRZWY_P_Tmr@@YGJJPAE@Z
?wm_raMJkkgANFF_BUA_X@@YGPAMDG@Z
?rfhfpiIl_oksth_w_zb@@YGXK@Z
?JDM_EYWSJ@@YGEPA_NE@Z
?ondcr___x@@YGPADPAK@Z
?H_AFJR_MllcvoFTC@@YGDJPAI@Z
?XJRS_bncd_xhSMM__K_@@YGMPAJ@Z
?rljJRK_CKTODL_YYXthzJT@@YGPAMPAD@Z
?jahvg__xf_O_jv@@YG_ND@Z
?o_cma_xsNE_Q_CF_renMC@@YGJM@Z
?lrEN_C_MKAYW_BNHO_J_Ei@@YGDK@Z
?XE_LTO_Pi_f_zBTLGR_RSm@@YGPAKPA_N@Z
?_h___lb__lu_yxJ@@YGFFG@Z
?q_ohy_vROHM@@YGPAIHD@Z
?G_G_XKBPYG_jbqTFW_RK@@YGPAXJ@Z
?_hjxirafkzlg_egzeG_PZI@@YGPAXDM@Z
?_NDZFCFXA@@YGXJ@Z
?_I__BUBY_kd@@YGKGH@Z
?di_zpqXAMMhV_AXFPRVRE@@YGIJ_N@Z
?_MqAEQDEfs_@@YGE_NJ@Z
?_MN_T_DCrva_UKEQC@@YGPAGK@Z
?V_rOB_S_SQGn_@@YGXJ@Z
?wkfwoQAH_KZ@@YGPAKPAKK@Z
?t_we__j_ajx_whx_@@YGPANF@Z
?CLSUxl_fz_lkqQFK_SHi__@@YGPAND@Z
?_PH___KYDX_DL@@YGFI@Z
?jzpG_HWW_TA_@@YGPAKE@Z
?NITRQPRZXNG@@YGD_NE@Z
?FOzivfw@@YGGM@Z
?wx_ilt_UYN_aimy__HO@@YGXH@Z
?_M_FOZCYWDARFFJR@@YGPAHJG@Z
?rac_W_R@@YGJJ@Z
?Q_NKFK_S_@@YGFGF@Z
?_YGXB_JGKFYps_r@@YG_NJPAI@Z
?JOZnrskI_T__MMopb@@YGPAHE@Z
?Q_KS__WGjhmnuy@@YGMMD@Z
?h__KQJQ__JVJZN@@YGIPA_ND@Z
?Btbipzl_b__atYJKEE__@@YG_NI@Z
?rc_jzNYT_RWW_O_C_X_@@YGPAEGN@Z
?_vicvwhKKAVvybylSFWXy@@YGPAXI@Z
?x_tVqvoYPZT__S_lpHSG_P@@YGHPAH@Z
?tosixEfnr_ZXD__W_fsxlr@@YGFI@Z
?M_O__XPQ@@YGPANIPAG@Z
?J_D_N_R_O@@YGMD@Z
?wwg_QFPVP@@YGEJ@Z
?X_AW__iih_qEK@@YGPAJJPAF@Z
?wvzlP_X@@YGXPAK@Z
?YZA__DDzllzz_e_ybS_E_G@@YGPAH_N@Z
Sections
.text Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 34KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 499B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ