extexport.pdb
Behavioral task
behavioral1
Sample
1532692c0d5f48ff13da1a9573a2ac32_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
1532692c0d5f48ff13da1a9573a2ac32_JaffaCakes118
-
Size
129KB
-
MD5
1532692c0d5f48ff13da1a9573a2ac32
-
SHA1
9ddc835aeacc26277b3229c1e18e5d3172a29204
-
SHA256
e7efa53301467a00af2b31e407b3a9ff5df370123897bb44cbe0152665574646
-
SHA512
aad0acb98a96f2529a4d81b7c5093c15c665ede4e71c85c4ff94714e5b44d2e17180186aaca70228d9bab7b6a28042bc389a6659c8e5c65fc44132db7d97c452
-
SSDEEP
3072:+M8hxeCZ+wAJ355Z3VCyLHDHidJq9A1D3UqpRi9i:8B83fjHidk2jzs9
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1532692c0d5f48ff13da1a9573a2ac32_JaffaCakes118
Files
-
1532692c0d5f48ff13da1a9573a2ac32_JaffaCakes118.exe windows:6 windows x86 arch:x86
2151bc8ba0a135980492687962a2a8b7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetModuleFileNameW
LocalFree
DeleteFileW
MoveFileW
CreateDirectoryW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
DecodePointer
ExpandEnvironmentStringsW
CreateFileW
CloseHandle
lstrcmpW
WriteFile
LoadLibraryExW
lstrlenW
LoadLibraryW
GetProcAddress
LocalAlloc
FreeLibrary
InterlockedExchange
Sleep
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
msvcrt
_vsnwprintf
__getmainargs
iswalpha
wcschr
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_except_handler4_common
_controlfp
shlwapi
ord215
PathFindFileNameW
ord158
StrCmpNW
PathFileExistsW
StrStrW
advapi32
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
user32
LoadStringW
shell32
SHGetFolderPathAndSubDirW
SHSetLocalizedName
iertutil
ord672
ord675
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 994B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE