C:\complete.pdb
Static task
static1
Behavioral task
behavioral1
Sample
03dd37b7ef029c4fab8e62a7d48f712a_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
03dd37b7ef029c4fab8e62a7d48f712a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
03dd37b7ef029c4fab8e62a7d48f712a_JaffaCakes118
-
Size
147KB
-
MD5
03dd37b7ef029c4fab8e62a7d48f712a
-
SHA1
ab59c1e09d121bc8fd35858980b19b391d56a2d6
-
SHA256
31a471e10ad8685a438ad36ef1fc151357d0d2865acbdc1bd62339e0ae70d782
-
SHA512
002ecdbc596b1fb6ba2a6b79bee8f64cf3f4656e3842d007299fda05da035d98e929e8189e8ca9b9c581f9d5845ae2ff20d3a709b706e254d54bfccc47458791
-
SSDEEP
3072:+XE/RKtYh3DUMPkHAnhl63jsKrI1zGzdhJSUVWLUXXY:uEwtODUmAAnhlsjlEYzd5WMX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03dd37b7ef029c4fab8e62a7d48f712a_JaffaCakes118
Files
-
03dd37b7ef029c4fab8e62a7d48f712a_JaffaCakes118.exe windows:4 windows x86 arch:x86
f1eab155445434cb069413d4d61cb05a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WritePrivateProfileStringA
GetDriveTypeA
LocalAlloc
LocalFree
GetProcAddress
FreeLibrary
InterlockedExchange
GetLastError
LoadLibraryA
RaiseException
GetSystemTimeAsFileTime
GetModuleHandleA
GetCommandLineA
GetVersionExA
WideCharToMultiByte
GetTimeZoneInformation
ExitProcess
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
HeapAlloc
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
IsBadWritePtr
RtlUnwind
VirtualQuery
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLocaleInfoA
VirtualProtect
GetSystemInfo
Exports
Exports
ForceMap
someRound
stopReach
Sections
.text Size: 80KB - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ