d:\rBot_0.3.3-pub-Moded_By Silicon_Wolf\Debug\rBot.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e1981e01c49906f8fa0de50d93b0d50f_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e1981e01c49906f8fa0de50d93b0d50f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e1981e01c49906f8fa0de50d93b0d50f_JaffaCakes118
-
Size
293KB
-
MD5
e1981e01c49906f8fa0de50d93b0d50f
-
SHA1
08fb6dc5020647be9d90935e20b51fe539cec41d
-
SHA256
f643e7501cee5973abdd556dfb3cf64d74e96c21d1abdf8cfa321d95bd53c308
-
SHA512
d99401077f67917fd20ff752ca96179a1db443f01321b0416bbe610a8dd19047677e57b71dc36a56c99e9d3dadadc22f47e8d88088cfa09fd43f81291757e898
-
SSDEEP
6144:SZWeA3qoSmcSOUbUgNE9ma3R87IcT2SA:SZs3qoSmUUbL8maR8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e1981e01c49906f8fa0de50d93b0d50f_JaffaCakes118
Files
-
e1981e01c49906f8fa0de50d93b0d50f_JaffaCakes118.exe windows:4 windows x86 arch:x86
5378e3699817acd02ef4e4556911f743
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Sleep
GetLastError
CreateThread
GetModuleFileNameA
ExitThread
LeaveCriticalSection
EnterCriticalSection
GetTickCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLocalTime
CloseHandle
WriteFile
CreateFileA
ReadFile
SetFilePointer
GetFileSize
GetSystemDirectoryA
MultiByteToWideChar
TransactNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ExitProcess
CreateProcessA
FindClose
FindNextFileA
FindFirstFileA
FreeLibrary
GetEnvironmentVariableW
GetProcAddress
LoadLibraryA
HeapFree
HeapAlloc
GetProcessHeap
FileTimeToSystemTime
FileTimeToLocalFileTime
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
OpenProcess
GetTimeFormatA
GetDateFormatA
GetFileAttributesA
GetModuleHandleA
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
ExpandEnvironmentStringsA
SetFileAttributesA
GetTempPathA
WideCharToMultiByte
GetComputerNameA
CopyFileA
GetCurrentProcess
TerminateProcess
DeleteFileA
GetCurrentProcessId
WaitForSingleObject
CreateMutexA
TerminateThread
MoveFileA
GetExitCodeProcess
PeekNamedPipe
DuplicateHandle
CreatePipe
SetConsoleCtrlHandler
GetLocaleInfoA
GetVersionExA
GetLogicalDrives
WaitForMultipleObjects
GenerateConsoleCtrlEvent
GlobalMemoryStatus
IsBadWritePtr
IsBadReadPtr
HeapValidate
RtlUnwind
GetStartupInfoA
GetCommandLineA
DebugBreak
GetStdHandle
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
TlsAlloc
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
SetLastError
GetCurrentThread
GetACP
GetOEMCP
GetCPInfo
FatalAppExitA
HeapReAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
VirtualProtect
VirtualQuery
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStringTypeA
GetStringTypeW
IsValidLocale
IsValidCodePage
EnumSystemLocalesA
GetUserDefaultLCID
InitializeCriticalSection
InterlockedExchange
GetSystemTimeAsFileTime
SetStdHandle
FlushFileBuffers
SetUnhandledExceptionFilter
IsBadCodePtr
GetTimeZoneInformation
SetEndOfFile
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
Sections
.text Size: 221KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 52KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 19KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE