C:\Users\Yordanyan\source\repos\ActiveAgent\Release\ActiveAgent.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c243085c4df848ae674f73e261b06bee_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c243085c4df848ae674f73e261b06bee_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c243085c4df848ae674f73e261b06bee_JaffaCakes118
-
Size
1023KB
-
MD5
c243085c4df848ae674f73e261b06bee
-
SHA1
efd0b9f53429a6b14639d2aff756d2998147011a
-
SHA256
20909c097ee989b9c23552b498b07a5563496cfd96c514f64a593c2802c48ad4
-
SHA512
13a45427363e23a0f939bfc0272738f7bb892d9eb936d0234776c9f77ef4d3322ef0bf706432c3a54498fb05e595d44618ca50d79a6ca1c48cf262702807ec65
-
SSDEEP
24576:4kK+twz9L3YTu5Tm8gDrIKv8QgL2vBBCqffT3bewBH6s:+pFDB52JBPffTrzH6s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c243085c4df848ae674f73e261b06bee_JaffaCakes118
Files
-
c243085c4df848ae674f73e261b06bee_JaffaCakes118.exe windows:6 windows x86 arch:x86
77cad9c01c06b79f2963154fd04525cc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Sleep
WaitForSingleObject
OutputDebugStringW
OpenProcess
TerminateProcess
GetCurrentProcessId
WriteConsoleW
GetLastError
CreateMutexW
GetVersionExW
HeapSize
CreateFileW
ReadConsoleW
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindNextFileW
GetModuleFileNameW
FindClose
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
HeapAlloc
HeapFree
WriteFile
GetStdHandle
ExitProcess
RtlUnwind
GetStartupInfoW
CloseHandle
FindFirstFileExW
GetCurrentProcess
GetSystemTimeAsFileTime
GetModuleHandleA
FormatMessageW
VerSetConditionMask
GlobalFree
VerifyVersionInfoW
EncodePointer
DecodePointer
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
QueueUserWorkItem
GetModuleHandleExW
IsProcessorFeaturePresent
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
CreateTimerQueue
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetEndOfFile
advapi32
OpenProcessToken
GetTokenInformation
shell32
ShellExecuteW
ShellExecuteExW
ole32
CoInitialize
CoCreateInstance
urlmon
URLDownloadToFileW
winhttp
WinHttpSetStatusCallback
WinHttpGetDefaultProxyConfiguration
WinHttpOpen
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpSetCredentials
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpSetOption
WinHttpQueryOption
WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpConnect
bcrypt
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
crypt32
CryptUnprotectMemory
Sections
.text Size: 722KB - Virtual size: 722KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 175KB - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 46KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ