d:\VS2005_Project\1234Ware\release\1234Ware.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d67dccc2a81aaa49c0f1b17c9c0ea5ac_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d67dccc2a81aaa49c0f1b17c9c0ea5ac_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d67dccc2a81aaa49c0f1b17c9c0ea5ac_JaffaCakes118
-
Size
392KB
-
MD5
d67dccc2a81aaa49c0f1b17c9c0ea5ac
-
SHA1
31dc4908197c505b47b6f8142822aec97d186a2f
-
SHA256
c2ad7679474fb181de8ed14c703b7e3eb7eb7d224220dc840d4f21ffa2cd8423
-
SHA512
a37f4aaf27865d02667c8f508248745daa16cf1832bb4a122e12b0cfeec2ce2ef5884c6d9a1710fd0fde97688c2ec30265aacd3e4ac32eb28586a4c46604dd65
-
SSDEEP
6144:a40kKmEJjpeMpJ+OHHUTfxbA2GsR4k5Y1UwC/lPk+h13WU1mdhETlG4j93BxDO+/:aVJvNo4erMTNEXI535Tr4Navi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d67dccc2a81aaa49c0f1b17c9c0ea5ac_JaffaCakes118
Files
-
d67dccc2a81aaa49c0f1b17c9c0ea5ac_JaffaCakes118.exe windows:4 windows x86 arch:x86
de29d07560e35600a90fecf9aed95b71
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LockResource
LoadResource
FindResourceExA
WideCharToMultiByte
GetModuleFileNameA
ReadFile
FreeResource
LoadLibraryA
CreateFileA
FindFirstFileA
FindClose
GetVersionExA
MultiByteToWideChar
InterlockedExchange
CompareStringA
GetLastError
lstrlenA
CompareStringW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetACP
GetLocaleInfoA
GetThreadLocale
SetEndOfFile
FlushFileBuffers
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
SizeofResource
FindResourceA
SetEvent
CloseHandle
WaitForSingleObject
Sleep
CreateEventA
DeleteFileA
MoveFileA
VirtualAlloc
GetProcAddress
GetModuleHandleA
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
WriteFile
GetConsoleCP
GetConsoleMode
HeapCreate
VirtualFree
GetStdHandle
GetTimeZoneInformation
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
SetEnvironmentVariableA
user32
UnregisterClassA
advapi32
RegCreateKeyExA
RegQueryValueExA
StartServiceCtrlDispatcherA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegisterServiceCtrlHandlerA
SetServiceStatus
shell32
SHGetFolderPathA
Sections
.text Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 252KB - Virtual size: 251KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ