c:\Against\Began\rain\SeedPoem.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f9c6667169a79f03670f6db49d52ea28_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
f9c6667169a79f03670f6db49d52ea28_JaffaCakes118
-
Size
376KB
-
MD5
f9c6667169a79f03670f6db49d52ea28
-
SHA1
82936320da04461b42d6c39b836d31ab29748419
-
SHA256
7371e66760ef88fbd540afb7de0326b817a71846b57c4629664b9074cc85207e
-
SHA512
dd347bf303940f13cc9491c3e085c18db1ac15cacdc65b4e03324e327d1d71f470b77b4951dbce9d192b054638db4867c5b33429ecf04998b306628716cb56e6
-
SSDEEP
6144:tFqTpMmb37r+TiZNAqMRQzRZZxKxMFihFAzieQuLNMEC:t0NDmoNAF0RZZxKGIFAzieQuLN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9c6667169a79f03670f6db49d52ea28_JaffaCakes118
Files
-
f9c6667169a79f03670f6db49d52ea28_JaffaCakes118.exe windows:5 windows x86 arch:x86
fd499d619bda8779f56e774da257a7f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetStringTypeA
MultiByteToWideChar
LCMapStringA
LCMapStringW
CompareStringA
GetLocaleInfoA
GetStringTypeW
HeapSize
RtlUnwind
VirtualAlloc
CompareStringW
VirtualProtectEx
Sleep
GetCurrentDirectoryA
GetProcessHeap
HeapAlloc
GetSystemDirectoryA
LoadLibraryA
WaitForSingleObject
CreateMutexA
OpenMutexA
DeleteFileA
FindFirstChangeNotificationA
ResetEvent
GetEnvironmentVariableA
GetShortPathNameA
PeekNamedPipe
DuplicateHandle
GetCurrentThread
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
WideCharToMultiByte
GetTimeZoneInformation
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
RaiseException
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetEnvironmentVariableA
user32
SendDlgItemMessageA
InflateRect
SetParent
SetClipboardData
DestroyWindow
EndDeferWindowPos
IsClipboardFormatAvailable
SendMessageA
CheckRadioButton
SetForegroundWindow
IntersectRect
ExitWindowsEx
comctl32
ord17
ImageList_SetOverlayImage
DestroyPropertySheetPage
CreateToolbarEx
ord6
ImageList_LoadImageA
comdlg32
GetSaveFileNameA
ReplaceTextA
GetOpenFileNameA
ole32
OleUninitialize
OleSetContainedObject
OleInitialize
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid
FreeSid
OpenProcessToken
StartServiceCtrlDispatcherA
InitializeSecurityDescriptor
RegEnumKeyA
RegSetValueExA
RegisterServiceCtrlHandlerA
SetServiceStatus
AdjustTokenPrivileges
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
GetTokenInformation
LookupPrivilegeValueA
rasapi32
RasGetConnectStatusA
RasEnumConnectionsA
RasHangUpA
Sections
.text Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ