d:\FireFox Plugin\installation\UnInstallPDFReaderPlugin\Release\UnInstallPDFReaderPlugin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c98f23c7bed9a75e378ef992e5866f34_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c98f23c7bed9a75e378ef992e5866f34_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c98f23c7bed9a75e378ef992e5866f34_JaffaCakes118
-
Size
165KB
-
MD5
c98f23c7bed9a75e378ef992e5866f34
-
SHA1
e69198ef683d12977096bd29fc7e8c19991a4ef2
-
SHA256
fe3eda029961630ff90ac56d5136ca2860755c55b2b2a0d0ca85b8af834cbe96
-
SHA512
5672b259db4d06fea2a7f194c34151bb97fa8007e371837b83d4400e8aca0fbaabe8d6b0d96142edbea4899bdbc92265e89618ec617c77abe9f7d2ad883eecaa
-
SSDEEP
3072:jVBhSS01FmNt1ZnVK8KEzP355MgmiBb0hyzMG3cgaNLl2unM:jEHnMtV3j0grVw0Aa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c98f23c7bed9a75e378ef992e5866f34_JaffaCakes118
Files
-
c98f23c7bed9a75e378ef992e5866f34_JaffaCakes118.exe windows:4 windows x86 arch:x86
55b1ad35a013c5bc7a733b85c4406564
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FileTimeToSystemTime
LoadLibraryA
GetProcAddress
FreeLibrary
DeleteFileA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
GetLastError
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
WideCharToMultiByte
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
HeapSize
InitializeCriticalSection
advapi32
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyA
RegOpenKeyExA
RegCloseKey
RegEnumValueA
Sections
.text Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE