t:\word\x86\ship\0\winword.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c20cf09943265421fb56c6182029e199_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c20cf09943265421fb56c6182029e199_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c20cf09943265421fb56c6182029e199_JaffaCakes118
-
Size
469KB
-
MD5
c20cf09943265421fb56c6182029e199
-
SHA1
0cf32e98f238e9383a87d63fffc34767f36ff635
-
SHA256
3824e945011b3154afdf2b73bd769964ccaf7d372edb21f093776774e191f862
-
SHA512
f77f2955afc5c87a6588efb178143fe518085db9269d9bfcffb38ef617342051198af65d8be336173bb6e2795471841c70482505d2d6d9c5040425137c5b2ec0
-
SSDEEP
12288:l1nIO39YAeNLFjAYarEdrEb5P6VxY1KldxD:l1IsJeNhaodobEPldF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c20cf09943265421fb56c6182029e199_JaffaCakes118
Files
-
c20cf09943265421fb56c6182029e199_JaffaCakes118.exe windows:4 windows x86 arch:x86
838aedcd0095eb96c227963c269abc0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LoadLibraryExW
LoadLibraryW
GetProcAddress
GetLastError
GetSystemDirectoryW
FreeLibrary
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
IsDebuggerPresent
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
msvcr80
_crt_debugger_hook
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
__set_app_type
Exports
Exports
DllGetLCID
wdCommandDispatch
wdGetApplicationObject
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 900B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 386KB - Virtual size: 385KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.ddata Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE