c:\dnem\nexyby\qlyc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
df6c0a7bca32f43c21d945e5aa8aaa90_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
df6c0a7bca32f43c21d945e5aa8aaa90_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df6c0a7bca32f43c21d945e5aa8aaa90_JaffaCakes118
-
Size
166KB
-
MD5
df6c0a7bca32f43c21d945e5aa8aaa90
-
SHA1
5c86138ce2ffb5990014ca09416ff160fd43f819
-
SHA256
65e41ff30bb75c653aa38b92d0e50ca094525a9f7268b4a9fc9b029971d32afe
-
SHA512
cafac9015c210d9d8061f525e9a31965d1a00501960cd5a316a496d2b003d438bfcb94a5bdda0bd6530020fa84b2559b4243566a72278b32ebb477f99cd88d7c
-
SSDEEP
3072:IpQVuzTDORboN4cgtxQG0x++HydNVMbGD9OLlxQhly7wvDkgXw+HAc2lXQvD:IuVwTCRbLcgtCGo/HydqXZxqu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df6c0a7bca32f43c21d945e5aa8aaa90_JaffaCakes118
Files
-
df6c0a7bca32f43c21d945e5aa8aaa90_JaffaCakes118.exe windows:4 windows x86 arch:x86
6d85d311b5b0159003b32b786ad030bd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
gdi32
GetRasterizerCaps
GetRelAbs
StretchBlt
DeleteObject
kernel32
AllocateUserPhysicalPages
CancelIo
CreateRemoteThread
ExitProcess
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
GetCommProperties
GetCommandLineA
GetCurrentProcess
GetEnvironmentStringsW
GetFileType
GetLastError
GetModuleHandleA
GetProcAddress
GetStringTypeA
GetStringTypeW
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
LoadLibraryA
MultiByteToWideChar
RequestWakeupLatency
RtlUnwind
SetCommTimeouts
SetHandleCount
Sleep
TerminateProcess
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WaitForMultipleObjectsEx
WaitForSingleObject
WideCharToMultiByte
WriteFile
_lread
lstrcpyA
shell32
SHGetDesktopFolder
SHGetUnreadMailCountW
SHOpenFolderAndSelectItems
DragQueryPoint
Sections
.text Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ