R:\lmvoDqCcaiDp\LpjifHtL\HQggcJpJfz\UfnmhDu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d0a0e39689c0aa10590944fb11f563d9_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d0a0e39689c0aa10590944fb11f563d9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d0a0e39689c0aa10590944fb11f563d9_JaffaCakes118
-
Size
52KB
-
MD5
d0a0e39689c0aa10590944fb11f563d9
-
SHA1
b20dca8334978e635b9f3d6579fbd47e336957b2
-
SHA256
f6ffce3300b9a5a263a5a0602b2e83dd479a62ba17e1966f7e39adf13f711cc5
-
SHA512
20719ac8147a28493dcb1cdb445f75e278c88e327eb273f4e831cf830c5fbff4b693e11d9919bf45b509ab31ba16251ad686151b9e7cbd15e0495b7417915b4f
-
SSDEEP
1536:Aul/7mEsbVOTxUOJxwHLR7CPQ4bbeXm5h:baAwCbeW5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d0a0e39689c0aa10590944fb11f563d9_JaffaCakes118
Files
-
d0a0e39689c0aa10590944fb11f563d9_JaffaCakes118.exe windows:5 windows x86 arch:x86
db3ef33dc606dbb3b52da2feabaee317
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntdll
memset
strcspn
kernel32
EnumResourceLanguagesA
WaitForSingleObject
GetFileSize
CompareStringW
lstrcpyA
RegisterWaitForSingleObject
lstrlenW
TlsGetValue
GetLocaleInfoA
GetCommandLineA
LCMapStringA
GetCommModemStatus
FindNextChangeNotification
CreateEventW
lstrcmpiW
GetStringTypeExW
comctl32
ImageList_Read
ImageList_GetImageCount
msvcrt
exit
user32
MapWindowPoints
CharNextA
CreateIconFromResource
OpenInputDesktop
TrackPopupMenuEx
GetSysColorBrush
PostThreadMessageW
DialogBoxIndirectParamA
ReleaseDC
DispatchMessageW
GetUpdateRgn
ScreenToClient
GetDoubleClickTime
GetSystemMenu
LoadMenuW
GetMenuState
TranslateAcceleratorW
CharLowerW
DeleteMenu
ClipCursor
ReplyMessage
DestroyCaret
MapVirtualKeyA
SetScrollRange
BeginPaint
GetMessageW
GetSystemMetrics
CharLowerA
EnableMenuItem
gdi32
GetDeviceCaps
GetSystemPaletteUse
ScaleWindowExtEx
GetSystemPaletteEntries
PtVisible
CombineRgn
TextOutW
PolyBezier
LineTo
EnumFontFamiliesExW
RectVisible
GetTextAlign
comdlg32
GetSaveFileNameW
GetOpenFileNameW
ChooseColorW
shlwapi
UrlGetPartW
PathMatchSpecA
Exports
Exports
?_VFXsmog_@@YGGPAEPAI@Z
?J_ENCUVKXIOKeKRMbbG@@YGPAD_NH@Z
?oy_fy_b_sk_fiyPCTUC__@@YGPAIPAI@Z
?lzoojFMEHAM_atvwQd@@YGFI@Z
?apwilq_kpz_jt_ozpwlx@@YGMIK@Z
?ATQfsudsDMP_YYM_D_C@@YGXJH@Z
?UPK_Mxf_bekeveq_@@YGKEPAG@Z
?__BY_DTKD_Xu@@YGXE@Z
?ts_xdml_@@YGHKPAN@Z
?__crcc___rytzfmhS@@YGHPAI@Z
?XR_Y__H@@YGPADPAEF@Z
?GB_VIpqJ@@YGDFH@Z
?sz_zykt_LG_@@YGHPA_N@Z
?pjtwk_hifcV__@@YGFM@Z
?WEdwlztxlsOVNMEZde@@YGPADPAMI@Z
?W_AO_V_@@YGHM@Z
?F_KD_Vx_ehH_NFXQTIIYFn@@YGXPAFF@Z
?wttn__g_s_g_W@@YGIPA_N@Z
?o_ygkjqPYS_EMNQNZ@@YGXJ@Z
?bt_zhJSrYOYYJq@@YGMF@Z
?svame_P@@YGKH@Z
?CK_evhx_wBYRH_jrppRORR@@YGKKE@Z
?o__JFSyng_@@YGPAXGH@Z
?b__qpBWWsolb___yy_g_un@@YGEHN@Z
?HHFQGGR_UQFEOwimzNU_W_@@YGPAJG@Z
?AAGTAFRMI_M_sekP_Lxuxf@@YGPAXPAH@Z
?lanTI___QFIaurJ__@@YGPAFFF@Z
?__QuFZGTKDul@@YGPAIPAD@Z
?_xk_lw_giNR__NMPp_@@YGIH@Z
?qn_qdbekps_kco_a_zTW@@YGMHPAJ@Z
?MY_clmRDERAZPF@@YGGPAHK@Z
?YIGfzpxdfYDI_RLWFZ_ud@@YGHM@Z
?zbyetZGFBVSu_l_iumaybO@@YGEPAG@Z
?_GIM_TCm___Koxxmv_y@@YGXK@Z
?_bg_juzaPTD_O@@YGPAX_NM@Z
?MG___SD@@YGKHN@Z
?ko_iecug@@YGPAJGJ@Z
?IQiz_wyuESU_QZi_a@@YGNDK@Z
?P_SAXO_HWXINweh@@YGXPAD@Z
?xSTXezvVECAyxpxnw_lj@@YGPAJF@Z
?Y_z_wgsqh_vbfxgdJ_ee_@@YGNI@Z
?_PG_IXCn_m_xxakmk@@YGFPAFK@Z
?_y__ji_airKRS@@YGPAFPAD@Z
?f_zeyermdOEeisn__yag@@YGXHG@Z
?___NAZXnybjd_o@@YGPAI_N@Z
?BCGHDO__FL_GK_MD_F_HFS@@YGDPAJ@Z
?zjxstlpjpb_@@YGPAMPAMF@Z
?__tgvgRNV@@YGKHE@Z
?VJAOK__GCaR@@YGPAHPAFM@Z
?_i__j__RL@@YGXH@Z
?gtbnyqVvs@@YGMIJ@Z
?awzwz__ot__p@@YGIPAK_N@Z
?ld___gpaWSRzxx_uggdeor@@YGPAKPAD@Z
?z_b_br_gqg_rk_lp@@YGDPAD@Z
?jzEHJV_P_A_EH_lcOH@@YGJPAJ@Z
?RqlgIDfxkc_@@YGFPAIE@Z
?EIFTYX_YRTEx@@YGNIE@Z
?O_S_U_vkzv_@@YGEPAIG@Z
?TLHXSouw_ALXL_v@@YG_NPAHF@Z
?ZM_FYvzy@@YGEPADI@Z
?NSv_uuhd_m_i_kvksBNY@@YGGI@Z
?FITAP__JW_RRIY___wjp_@@YGEPAFPAD@Z
?WDZFAYPMpf_zakguFJPLfx@@YGHK@Z
?U_NNYUCOdcjddf_fXUIV@@YGXPAE@Z
?wueyq_kW__J@@YGGPAD@Z
?LKISevvkjfzpaYE@@YGPAXEPAG@Z
?_g__NQZgao_@@YGXEPAD@Z
?vrpqswucui_ZIGE__I_DJP@@YGHGPAG@Z
?__AEIWXDHRV@@YGPAEDK@Z
?HDPPJZYDPVo_l@@YGDJ@Z
?edb____j__JF_K_@@YGPANPAG@Z
?qaexk_gKOF_BXrv@@YGEFG@Z
?QKDHJUf_W_@@YGGE@Z
?svwIXXSbwwfrLUT_x__@@YGNPAF@Z
?L_JD_EOzI@@YGPAXMPAE@Z
?vc_tihVM@@YGMPAJ@Z
?D__K_R_G@@YGPA_NJG@Z
?b_tarut_wf_vana_lY@@YGPADM@Z
?gtidAXiB_@@YGE_NM@Z
?MQCDAWTZHUE@@YGPANPAN@Z
?_h_bSCX@@YGKN@Z
?HDJ_T_ZX@@YGXPAGF@Z
?zdAPW_MBS_AP@@YGEPAD@Z
?jaeglGEP_@@YGDD@Z
?__xcczb@@YGFPAFN@Z
?ZLCTQEZen_@@YGXPAE@Z
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ldata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 515B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ