S:\oagZFcdswrIhXe\euvqinhhryjfp\oqSyGLqhRkzQ\escIPNcaQOva.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d6c2ad010db7cef3a5b1764d9fbb8e21_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d6c2ad010db7cef3a5b1764d9fbb8e21_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d6c2ad010db7cef3a5b1764d9fbb8e21_JaffaCakes118
-
Size
144KB
-
MD5
d6c2ad010db7cef3a5b1764d9fbb8e21
-
SHA1
847106201b42afe4d707aba9216f275708bdfe5e
-
SHA256
b0027decce94106cf9b18f580a91cf8be4603a752d2e98b5893e0f20a1fbc0b7
-
SHA512
fd47b0d8f3d0f591a12a39e56ec49fbb4fe9ddc96efb127f92f6eaff8d2c5a3bcdaa195d9e5d20e45a897d8d3f841bd35a6dfd1cb9cc61519c37958caef70784
-
SSDEEP
3072:I8rJvRNNRi1HrKmVQJpqCCX2L3UmjlAHF0ERJsUdjg8VtNs9/U:IqRi4JpqUblAvnVMktNs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d6c2ad010db7cef3a5b1764d9fbb8e21_JaffaCakes118
Files
-
d6c2ad010db7cef3a5b1764d9fbb8e21_JaffaCakes118.exe windows:5 windows x86 arch:x86
e4582b9239cc4d3e291b96fc97f461be
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
ArrangeIconicWindows
CharNextW
GetIconInfo
EnableScrollBar
SetWindowLongW
PostMessageA
ReplyMessage
TranslateAcceleratorW
IsChild
wvsprintfW
DefDlgProcW
CheckRadioButton
UnionRect
PostQuitMessage
LoadImageA
GetKeyboardLayout
CreateIconFromResource
CreateCursor
EnumChildWindows
CharUpperW
wsprintfW
ScrollWindowEx
DefFrameProcA
CreateMenu
DrawEdge
InvalidateRect
EnumThreadWindows
SetActiveWindow
ChildWindowFromPointEx
FindWindowExA
DrawTextExW
FindWindowExW
GetDCEx
CreateDialogParamA
GetMessagePos
SendNotifyMessageW
CascadeWindows
LoadCursorA
DragObject
CopyImage
GetMessageExtraInfo
GetMenuStringW
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_amsg_exit
strcpy
strcoll
_initterm
calloc
_acmdln
exit
wcscoll
vsprintf
_ismbblead
_XcptFilter
_exit
gmtime
_cexit
wcspbrk
__setusermatherr
setlocale
__getmainargs
getenv
wcscmp
isalnum
iswprint
comctl32
ImageList_GetImageCount
PropertySheetA
PropertySheetW
ImageList_ReplaceIcon
gdi32
IntersectClipRect
GetClipBox
RoundRect
DPtoLP
CreateDiscardableBitmap
GetROP2
CreateDIBitmap
UnrealizeObject
PathToRegion
SetBkMode
CreateSolidBrush
SetDIBitsToDevice
SelectPalette
LPtoDP
TextOutA
TextOutW
StartPage
ExtFloodFill
shlwapi
StrToInt64ExA
PathRemoveBlanksW
ChrCmpIA
kernel32
Sleep
SleepEx
ConvertDefaultLocale
GetLastError
CreateSemaphoreA
GetFileInformationByHandle
GetFileTime
GetModuleFileNameW
VirtualQuery
WaitForMultipleObjects
LocalReAlloc
EnterCriticalSection
ReleaseMutex
IsValidLocale
GetModuleHandleA
ExitProcess
SetLocalTime
SetCommTimeouts
VerifyVersionInfoW
AreFileApisANSI
DisconnectNamedPipe
SetErrorMode
Exports
Exports
?SendProfileEx@@YGPA_NE~U
?FindNameW@@YGPAFHH~U
?EnumHeightEx@@YGPAEPA_N~U
?AddSystemExA@@YGNENPAE~U
?InstallVersionExA@@YGXIPAI_NF~U
?ModifyPointExA@@YGJFPAEJ~U
?SetFolderW@@YGPANE~U
?GlobalTask@@YGFGPAIHPAJ~U
?DeleteComponentA@@YGPAJPAENF~U
?GeneratePenExW@@YGFJPAKPAM~U
?CancelPenNew@@YGPAXM~U
?CancelWindowInfoOld@@YGEJPAM~U
?IsNotMediaTypeOld@@YGFF~U
?InstallDirectoryEx@@YGGM_N~U
?SetMutexA@@YGPAHF~U
?IncrementFullNameExW@@YGKPAF_NG~U
?SendSizeEx@@YGGPAIIJ~U
?InvalidateDateTimeExW@@YGXMJ~U
?CloseSystemNew@@YGPAKJHPAF~U
?CrtOptionExW@@YGPAXGN~U
?FreeDataW@@YGINDM~U
?FindProviderExW@@YGPAIPA_N~U
?CopyModuleW@@YGXGPAJPAEM~U
?InsertTimerA@@YGKPA_NPAHPAFPAF~U
?DeleteObjectEx@@YGKPAKG_N~U
?PutThreadW@@YGPAGIHG~U
?IsNotProcessExW@@YGPADPAGE~U
?KillNameOld@@YGDIM~U
?GlobalChar@@YGKDDI~U
?DeleteDialogNew@@YGPAEIIPAD~U
?AddFullNameA@@YGXJIIK~U
?AddArgumentEx@@YGPANG~U
?IsListA@@YGPAEPAKEF_N~U
?SendPenOriginal@@YGPAMGPA_NM~U
?IsNotAnchorA@@YGPAMJD~U
?GetTimeOld@@YGXFGPAJM~U
?ShowHeaderExW@@YGPAF_N~U
?GetProfileOriginal@@YGXPAGID~U
?InsertObjectOriginal@@YGPADJK~U
?ShowFilePathExW@@YGXPAK~U
?ValidateWindowOriginal@@YGPAXPAI~U
?AddSemaphoreExA@@YGXPAJGGPAF~U
?AddKeyboardEx@@YGHJPAM~U
?FormatPathExA@@YG_NHPA_NPAH~U
?FreePenW@@YGPAENPAE~U
?FreeVersionExA@@YGXPAEJPAGJ~U
?AddDateW@@YGPAHPAJF~U
?DeleteArgumentEx@@YGPA_NFHMPA_N~U
?OnDateOriginal@@YGNDPAGJ~U
?OnStringOld@@YGG_NEHPAJ~U
?IsValidHeaderEx@@YGFFM~U
?SetClass@@YGEI~U
?IncrementDataExA@@YG_NPA_NDDJ~U
?IsValidTextOriginal@@YGKMMJ~U
?IsValidFunctionExW@@YGMIM~U
?FormatMutantA@@YGHPAFGK_N~U
?GetClassExA@@YGDPAIDPAKPAF~U
?ModifyPointW@@YGKJJ~U
?ShowPointNew@@YGIKIH~U
?IsNotDialogEx@@YGPAMD~U
?SetListNew@@YGFK~U
?DecrementCommandLineOriginal@@YGPAXJGPAM~U
?ValidateAppNameA@@YGDPAMJ~U
?HideKeyboardExA@@YGPAXPAMG~U
?CopyCharNew@@YGHMHHPAH~U
?CopyFullNameOld@@YGHPAFPAM~U
?CrtSystemEx@@YGPAGMHPAMD~U
?KillExpressionA@@YGPAIEPAMG~U
?ShowDataEx@@YGPAJPAED~U
?IsNotTaskExA@@YGGPAM~U
?ValidateObjectNew@@YGXE~U
?GenerateTextExA@@YGPA_NPAMPAFHPAN~U
?AddProjectExW@@YGPAFGJ~U
?FreeAppNameExW@@YGGMPAD~U
?CallEvent@@YGDH~U
?IsValidEventEx@@YGPAEFPAFKD~U
?FindTimerA@@YGIPAJPAJK~U
?CopySystemA@@YGXPAE~U
?OnSystemW@@YGIK~U
?CallStringW@@YGPAG_NE~U
?ProviderNew@@YGFPAKPAD~U
?KillPointerA@@YGPAIDKPAKK~U
?InvalidateProfileOriginal@@YGJD~U
?InsertMainStructDlhSi@@YGKGH@Z
?DecrementTaskOld@@YGEPAHJ~U
?CrtWindowInfoA@@YGJDJ~U
?ShowDialogW@@YGGPADEJ~U
?CopyPenOld@@YGMMPAHFPAI~U
?CancelPointerEx@@YGII~U
?RtlMutexNew@@YG_NM~U
?InsertPathOld@@YGXPA_NPAGII~U
?CloseDialog@@YGFIFH~U
?IsValidOptionOld@@YGPAXEHMPAJ~U
?InstallSizeEx@@YGPAMPADPAGJM~U
?IsValidTimerExW@@YGPAXPAMPAMPAMJ~U
?CopyMutexOriginal@@YGXPAGIF~U
?SendListItemOld@@YGGJFPAKPAF~U
?InvalidateDataNew@@YGPAGMDI~U
?PutCommandLineExA@@YGMGPAKPAJ~U
?LoadMutexA@@YGPAEEJNPAI~U
?GenerateVersionNew@@YGHEH~U
?EventW@@YGXM~U
?CrtSectionA@@YGJFM~U
?PutSectionOld@@YGXFEJPAN~U
?SetTextExW@@YGHIPAGPAJ~U
?RemoveValueOriginal@@YGPAFKPAKPAME~U
?EnumDataExW@@YGEJPAJPAI~U
?IsValidFolderExA@@YGXE~U
?HideSectionA@@YGIEMFE~U
?RemoveWidthOld@@YGIIE_N~U
?CopyRectEx@@YGXD~U
?AddSizeOriginal@@YGFPAGEHE~U
?FreeModuleOld@@YGXNPAG~U
?RtlMutantExW@@YGPAGPAGNPAFH~U
?IncrementAppNameW@@YGFDPAHG~U
?KillListA@@YGPAEDI~U
?PutMessage@@YGKM~U
?IncrementWidthExA@@YGXGPAM~U
?HideProfileExW@@YGIM~U
?KillValue@@YGEJ~U
?InstallTaskOld@@YGIG~U
?CrtText@@YGNPAMJ~U
?CancelTimerA@@YGPAEDPAGPAFPAI~U
?RemoveAppNameExA@@YGPAGPAF~U
?InstallRectNew@@YGDPA_NK~U
?CloseTimeExW@@YGDGMPAJ~U
?CallFolderA@@YGPA_NK~U
?CopyFilePathExA@@YGIPAMMDK~U
?IncrementDataExW@@YGXPAEKN~U
?FreeKeyNameW@@YGNHJHF~U
?ShowCharExA@@YGPAKG~U
?OnListItemOriginal@@YGPAXDK~U
?GenerateArgumentA@@YGIIPAN_NJ~U
?GetDateTimeNew@@YGPAFMPAHD~U
?IsValidTimeW@@YGJEDK~U
?CallOptionExW@@YGPADPAM~U
?FindStateOriginal@@YGX_ND~U
?CancelListNew@@YGGPAJPA_NFK~U
?IsOptionExA@@YGPAEED_N~U
?IsValidMutexExW@@YGDIMH~U
?ShowTimerOld@@YGXPAGPAHK~U
?SendMemoryExW@@YGDPAJ~U
?GenerateAnchor@@YGXPAG~U
?HideFolderPathNew@@YGJPADIPAF~U
?ShowComponentA@@YGKPAGHEG~U
?HideProcessNew@@YGIPAHKPAM~U
?GlobalOptionEx@@YGEJ~U
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rimp Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdbg1 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.redt Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rit Size: 1024B - Virtual size: 516B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdbg2 Size: 512B - Virtual size: 86B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rvar Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rpt Size: 512B - Virtual size: 333B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hdata Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ping Size: - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ