D:\code\boot\Debug\boot.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ef6ff00bf66cc864fbca6ce8815ce7c1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef6ff00bf66cc864fbca6ce8815ce7c1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ef6ff00bf66cc864fbca6ce8815ce7c1_JaffaCakes118
-
Size
443KB
-
MD5
ef6ff00bf66cc864fbca6ce8815ce7c1
-
SHA1
84f6bf980810a08f48bb3987bfb401796359872e
-
SHA256
e399e9183a639bbf5260bf2dc77d75577f964ee0298a76b308e6e9b07175c2c9
-
SHA512
80a44b67a97c6e3514cca9c8f8c3b6ba4824d22d5fc7861293221141bd92bb4dcddc171a2b4ad9fb7d4b62e4fbd9755b29f1439520440b636f56990deadeac90
-
SSDEEP
12288:azp2vFO55dQ9FCejJDMr3uTX54qwmFN7VK1s:VFO55diZVIO4WN7VKC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef6ff00bf66cc864fbca6ce8815ce7c1_JaffaCakes118
Files
-
ef6ff00bf66cc864fbca6ce8815ce7c1_JaffaCakes118.exe windows:5 windows x86 arch:x86
5e53e92025c39c3410fe51c4e0f7a039
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
wsock32
WSAStartup
gethostbyname
socket
htons
connect
send
recv
kernel32
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
WriteFile
CloseHandle
ReadFile
GlobalAlloc
FlushFileBuffers
GetModuleFileNameW
GetModuleHandleW
CreateFileW
GetSystemDirectoryW
Sleep
GetTickCount
GetConsoleMode
GetConsoleCP
CompareStringA
CompareStringW
GetFileSize
GetFileType
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
DebugBreak
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
GetProcAddress
LoadLibraryA
HeapValidate
IsBadReadPtr
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
SetEnvironmentVariableA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
HeapDestroy
HeapCreate
HeapFree
VirtualFree
HeapAlloc
GetProcessHeap
VirtualQuery
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
SetConsoleCtrlHandler
LoadLibraryW
InterlockedExchange
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoW
GetTimeZoneInformation
SetFilePointer
CreateProcessW
user32
wsprintfW
advapi32
RegSetValueExW
RegCloseKey
RegOpenKeyExW
Sections
.textbss Size: - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 348KB - Virtual size: 347KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ