Q:\yjymygeaKhY\rzbMOOijzLr\AfkaUnKbhdoA.pdb
Static task
static1
Behavioral task
behavioral1
Sample
02bbe7b3c5c5c4c0efb31a6f544d12cc_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
02bbe7b3c5c5c4c0efb31a6f544d12cc_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
02bbe7b3c5c5c4c0efb31a6f544d12cc_JaffaCakes118
-
Size
167KB
-
MD5
02bbe7b3c5c5c4c0efb31a6f544d12cc
-
SHA1
5905db261c23139f66a1e26e78851a201eccbebf
-
SHA256
c7c1f6b51b9072c4dea419c6b76632c1e9d8455cabd83def9a5da0fc6147ada4
-
SHA512
ee8b6ad87221f7cd97c8b681abc74169c156bc806e468a627387da9fd6948c9f91a002a8d48836614a91cc791a67e77d9be64bdb042ed31b8309d4467df334fc
-
SSDEEP
3072:8/mFO5tXHN24crpuXbMCMkU/skfJ68qlwrawlaf384Mcsm3m9UB+C:/M5bIClULJNqulIBCumWB+C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 02bbe7b3c5c5c4c0efb31a6f544d12cc_JaffaCakes118
Files
-
02bbe7b3c5c5c4c0efb31a6f544d12cc_JaffaCakes118.exe windows:5 windows x86 arch:x86
a0e135372369a2537c9e934f5d75cf59
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
gdi32
BitBlt
CreatePen
CreateDIBSection
CreateFontIndirectA
SetViewportOrgEx
StretchDIBits
ExtTextOutA
Rectangle
GetLayout
CreateBitmapIndirect
SetMapMode
SelectPalette
GetTextExtentPointW
GetClipBox
EnumFontsW
SetTextColor
SetPaletteEntries
GetViewportOrgEx
kernel32
DeleteAtom
GetFileType
ExitProcess
GlobalSize
CreateWaitableTimerW
SystemTimeToFileTime
SetFilePointer
CreateFileW
GlobalFlags
SetCurrentDirectoryW
lstrlenA
RemoveDirectoryA
AddAtomW
VerSetConditionMask
GetOEMCP
SetPriorityClass
GetTimeFormatA
LCMapStringA
GetModuleFileNameW
GetFileTime
GetComputerNameW
IsDBCSLeadByteEx
shlwapi
IntlStrEqWorkerA
StrToInt64ExA
ChrCmpIA
StrToIntW
PathRemoveBlanksW
comdlg32
GetSaveFileNameW
ReplaceTextW
ChooseColorW
user32
SendNotifyMessageW
SetActiveWindow
GetMessageW
SetCursorPos
GetCaretPos
GetMenu
GetActiveWindow
PostMessageA
CharLowerA
SetDlgItemTextW
DrawMenuBar
CallWindowProcA
AppendMenuW
ShowCursor
GetMenuItemCount
HideCaret
CreatePopupMenu
CharLowerBuffW
WaitForInputIdle
InflateRect
EnableMenuItem
GetScrollPos
RemoveMenu
GetKeyboardLayoutList
DefDlgProcA
SystemParametersInfoW
GetKeyboardLayout
LoadCursorA
GetClassInfoExA
ShowScrollBar
SetMenuItemInfoW
GetNextDlgTabItem
LoadBitmapA
DialogBoxParamW
CreateDialogParamW
SetWindowTextA
InsertMenuW
DrawIcon
GetWindowPlacement
GetKeyboardType
GetMonitorInfoW
DestroyIcon
RegisterClassW
FindWindowA
msvcrt
_controlfp
__set_app_type
__p__fmode
wcspbrk
swscanf
fseek
__p__commode
realloc
fflush
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
strtol
islower
mktime
_exit
_cexit
__setusermatherr
__getmainargs
strerror
wcsstr
qsort
remove
Exports
Exports
?CancelFilePathNew@@YGJPAM&U
?IsValidWindowNew@@YGJPAMHPA_N&U
?InvalidateTimerExA@@YGPAXPAM&U
?SetMonitorW@@YGPAIEJDPAK&U
?InsertCharNew@@YGFEHPAI&U
?CopyMutexW@@YGMHJF&U
?HidePathOriginal@@YGPAHF&U
?GlobalVersionExA@@YGHPADJFI&U
?GenerateRectOriginal@@YGPAHHEGPAM&U
?OnModule@@YGPAXJ&U
?OnCommandLineNew@@YGPA_NPAFDFPAF&U
?SendOption@@YGEPAJH&U
?IncrementClassA@@YGXMPAI&U
?GlobalValue@@YGMD&U
?PutPenA@@YGKDKFPAE&U
?CallListNew@@YGXFE&U
?FreeTaskNew@@YGHF&U
?InsertMainStructDlhSi@@YGKGH@Z
?GetListExA@@YGGIPAK&U
?FreeValueExW@@YGPA_NMPAJDG&U
?DeleteSemaphoreW@@YGPAXHPAGK&U
?ModifyScreenOriginal@@YGXFJ&U
?IsNotSectionExW@@YGXIMJI&U
?AddPathOld@@YGGPAJPAJPAF&U
?ShowMemoryOld@@YGPAFGPAIPAKE&U
?CrtCommandLineOld@@YGJPAGKFN&U
?FreeStringExA@@YGXPAMPAGIF&U
?RtlScreenA@@YGPAMI&U
?InvalidateListNew@@YGMFI&U
?CloseTaskOld@@YGFPAN&U
?InstallVersionW@@YGFPAM&U
?PutFolderA@@YGDPAD&U
?SendSemaphore@@YGNFPAKPAH&U
?FindArgumentOriginal@@YGPAMPAE&U
?FindNameA@@YGM_NF&U
?CopyListItemOld@@YGID&U
?CloseFolderExA@@YGMD&U
?RtlTextOriginal@@YGEPAIFNH&U
?CloseScreen@@YGJDK_N&U
?SendSectionEx@@YGNGJD&U
?InsertListExA@@YGIEPAK&U
?IsValidFolderOriginal@@YGPAJPAJPAGEG&U
?DeleteValueOriginal@@YGXJI&U
?ValidateClassA@@YGPAJPAEG&U
?RtlProviderExA@@YGFPAN&U
?InsertFileOld@@YGPAMPANG&U
?CopyAnchorA@@YGNEPAI_N&U
?SendTimerOriginal@@YGDEPAF&U
?CrtProviderOld@@YGXFE&U
?FormatPathNew@@YGXPADF&U
?CloseProviderOld@@YGPAXPAE&U
?DecrementObjectExW@@YGPAKJK&U
?ListExA@@YG_NPA_NPAKKPAF&U
?InvalidateStringA@@YGMH_NDPAD&U
?AddPointer@@YGFPAEPAJ&U
?AddModuleExW@@YGPAKPAEM&U
?ValidateMemory@@YGFHF&U
?GlobalMessageA@@YGPAGPAKM&U
?DecrementMessageA@@YGHM&U
?GenerateDateTimeExA@@YGFPAHPAJ&U
?IncrementClassW@@YGIMKI&U
?DecrementKeyboardEx@@YGPAJK&U
?ArgumentOld@@YGPAEDMPAND&U
?SetStateOriginal@@YGIKPAD&U
?KillHeaderOld@@YGPA_NPAGKD&U
?IncrementThreadA@@YGIHEPAHK&U
?GetDeviceOriginal@@YGKPAINEPAK&U
?ValidateFolderPathOriginal@@YGDPAMPAE&U
?IsNotPointerA@@YG_NHPADEH&U
?IncrementMutantExW@@YGPAXPAKPAMPAHPAF&U
?OnProviderExW@@YGPADHK&U
?CancelFolderPathEx@@YGPAJIPAD_N&U
?GenerateTimerExW@@YGFIPAE&U
?InvalidateTimeA@@YGNPAGK&U
?ValidateAnchorEx@@YGDPAGFFPAH&U
?InvalidateProcessW@@YGXF_N&U
?CopyHeaderExW@@YGHFPAENPAI&U
?InstallTaskOriginal@@YGGEK&U
?KillKeyboardOriginal@@YGPAKKGPAG&U
?DeleteProviderOriginal@@YGJ_NPANE&U
?PutDevice@@YGPAEIKE&U
?GenerateTextW@@YGPADPAH&U
?KillFileOld@@YGIJPAF&U
?IsNotFilePath@@YGFPAH&U
?DecrementEventExA@@YGDHPA_NPAK&U
?FormatProcessNew@@YGFPAMPAIPAJ&U
?KillEvent@@YGKGD&U
?CopyDirectory@@YGHKPAIM&U
?OnState@@YGPAFJ&U
?GetAppName@@YGXPA_NHM_N&U
?GenerateDateOld@@YGXPANPA_NPAG&U
?CallMemoryA@@YGGH&U
?IsNotPathNew@@YGPAKHPAKPAG&U
?DecrementStringExA@@YGPAHG&U
?GlobalMessageW@@YGPANMJ&U
?OnMessage@@YGPAHHKKG&U
?DeleteDateTimeOld@@YG_NGPAM&U
?InsertSystemW@@YGPAFPAKPAFPAG&U
?IncrementDateTimeExA@@YGPAKDHPAI&U
?OnMutexOld@@YGPAMNMPAKPAJ&U
?RemoveNameOriginal@@YGGPAE&U
?ShowScreenOriginal@@YGJG&U
?CloseTextEx@@YGPADHM&U
?DecrementComponentOld@@YGFPAG&U
?EnumStateOld@@YGFPAI&U
?ValidateOption@@YGGPAHK&U
?ShowProfileW@@YGKKJDPAH&U
?AddKeyboardExA@@YGXPAIPADN&U
?CharExW@@YGJH&U
?IsPointW@@YGGPAE&U
?OnNameNew@@YGMPAGDPAD&U
?IsComponent@@YGPAHJFMPAG&U
?CopyClassOld@@YGNPAJJ&U
?IsValidProviderNew@@YGHEEPAID&U
?FindComponentNew@@YGKPAHH&U
?SetKeyboardA@@YGPAXPADKH&U
?PutPathOld@@YGFD&U
?ShowDirectoryOld@@YGJKM_NE&U
?CopyNameA@@YGHM&U
?IsNotScreenEx@@YGPAJE&U
?SetProvider@@YGFGFE&U
?HideArgumentExW@@YGHPAIE&U
?FormatPenOriginal@@YGKPAFEPANJ&U
?ModifyTaskA@@YGGE&U
?CancelModuleW@@YGPAIG&U
?AddTaskEx@@YGEIPAME&U
?TextExA@@YGHGJPAE&U
?DeleteStringOriginal@@YGPAGFJF&U
?KillDataNew@@YGPADIPAIK&U
?ShowProjectOld@@YGPAXPAJHJH&U
?InstallValueEx@@YGXG&U
?PutFilePathExW@@YGMPAK&U
?CancelVersion@@YGIDH&U
?LoadListOld@@YGPAHD&U
?LoadTaskExW@@YGEKPAD&U
?CallPointerExW@@YGGJPA_NPAG&U
?EventExW@@YGXPAGPAE&U
?LoadSemaphoreA@@YGJH&U
?OnArgumentA@@YGPAXMMPAD&U
?OnSystemOriginal@@YGXK_NPAM&U
?CallDirectoryNew@@YG_N_NKPAHI&U
?EnumProcessEx@@YGPA_NMPAGPAHPAE&U
?PutProviderNew@@YGFMJMPAG&U
?InstallProcessExA@@YGJJPAI&U
?SetWidthEx@@YGPAEEKDPAD&U
?DecrementNameA@@YGGJPAK&U
?SetThreadExA@@YGGIPADPAK&U
?DecrementListItemOld@@YGEPAFH&U
?KillNameNew@@YGEPAE&U
?GlobalTimer@@YGPAHJEDK&U
?FolderPathA@@YGDPAIHPAH&U
?DeleteEventExA@@YGPAHH&U
?ShowScreenExW@@YGKMPAEPAEG&U
?CopyPenOriginal@@YGPAMPAGPAE_NH&U
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rimp Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.redt Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdbg1 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rit Size: 1024B - Virtual size: 528B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdbg2 Size: 512B - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rvar Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rpt Size: 1024B - Virtual size: 713B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hdata Size: 1024B - Virtual size: 736B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ping Size: - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ