c:\u\n\s\3120\Win32vc\asc\PRD\querykey\querykey.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ff38874ad166cf8e95c235afa1e00a5a_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ff38874ad166cf8e95c235afa1e00a5a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ff38874ad166cf8e95c235afa1e00a5a_JaffaCakes118
-
Size
200KB
-
MD5
ff38874ad166cf8e95c235afa1e00a5a
-
SHA1
1863b72e973c8db20d2ef2694fc358b50505f362
-
SHA256
ddaa404bc10c541003eda964abb2cb386cf8e74f2c59c268501d849fc7db0914
-
SHA512
ad4a3e4f746f2c41ea7d97d32db07098876f6e7a20e4af278ad28139efd6ddc03e25a2d6f7f534d8018ae958d1a7e3fa25827a405891145fbc89320a927f8640
-
SSDEEP
3072:cU6AEvMZjHIjgyOsavPg3bCjP2l9vfb5XdS2jWa2I2x4C9J+3TRrqrWgmUGDsD7D:cUTdXEa3g3++vTZdZrqsfDsfDkqu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff38874ad166cf8e95c235afa1e00a5a_JaffaCakes118
Files
-
ff38874ad166cf8e95c235afa1e00a5a_JaffaCakes118.exe windows:4 windows x86 arch:x86
bc482862e796cc1dee652051005245c6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
MessageBoxA
GetSystemMetrics
wsprintfA
kernel32
GetFileSize
MapViewOfFile
CreateFileMappingA
LocalFree
lstrlenA
GetLastError
GetVersion
MultiByteToWideChar
lstrcmpA
LocalAlloc
GetProcAddress
LoadLibraryA
FreeLibrary
WaitForSingleObject
CreateMutexA
ReleaseMutex
CreateEventA
OpenFileMappingA
CreateFileA
GetTempPathA
UnmapViewOfFile
FlushViewOfFile
OpenEventA
CloseHandle
WaitForMultipleObjects
InterlockedCompareExchange
GetCurrentProcessId
GlobalAlloc
GlobalFree
ResetEvent
WideCharToMultiByte
GetSystemDirectoryA
QueryPerformanceCounter
Sleep
DeviceIoControl
DefineDosDeviceA
QueryDosDeviceA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetEnvironmentVariableA
IsBadWritePtr
IsBadReadPtr
GetCurrentProcess
GetCurrentThread
GetPriorityClass
SetPriorityClass
GetThreadPriority
SetThreadPriority
GetVersionExA
InterlockedExchange
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
SetEvent
GetTickCount
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
advapi32
GetUserNameA
RegOpenKeyA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumKeyExA
ws2_32
recv
getpeername
send
bind
getsockname
closesocket
connect
gethostname
WSAStartup
WSAGetLastError
msvcr80
malloc
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
sprintf
__argv
__argc
_localtime32
_mktime32
_time32
memmove
atol
strftime
??2@YAPAXI@Z
free
??3@YAXPAX@Z
_stricmp
isalnum
strncpy
__CxxFrameHandler3
_getpid
toupper
sscanf
fclose
vfprintf
fopen
atoi
fprintf
_iob
strncat
strrchr
strchr
strtol
_mbsupr
getenv
_beginthreadex
mbtowc
wcslen
_pctype
_isctype
__mb_cur_max
strstr
fread
fgetpos
fseek
realloc
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_ctime32
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
Sections
.text Size: 153KB - Virtual size: 153KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ