c:\temp\vx.pdb
Static task
static1
Behavioral task
behavioral1
Sample
126e85e3cf023bd549fe6b4b59073e01_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
126e85e3cf023bd549fe6b4b59073e01_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
126e85e3cf023bd549fe6b4b59073e01_JaffaCakes118
-
Size
148KB
-
MD5
126e85e3cf023bd549fe6b4b59073e01
-
SHA1
915102b35b40f491448edeba7aa9a1b9613199e0
-
SHA256
cfcf8ad02470ff35735dbf8c0ddf215bb85ba8a7fbf62090c180a96157800497
-
SHA512
f38d53d8d6687393e0f81565a75c8fa21288f5a43cc906d7d350f459fdf20b5f4867b3745ec2526614b5bfaa45f0aea444239d0e1bea67426ee12ef6bd6cce71
-
SSDEEP
3072:jmIVrtcygJaDj3o4jjGRmaD/K3vUFOc7OSSB:KOEanGRmaD/KCYB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 126e85e3cf023bd549fe6b4b59073e01_JaffaCakes118
Files
-
126e85e3cf023bd549fe6b4b59073e01_JaffaCakes118.exe windows:4 windows x86 arch:x86
31c8b77d186aea476ecaf5e0875bc62c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Sleep
CreateEventA
GetLastError
VirtualAlloc
GetProcAddress
PulseEvent
InterlockedExchange
CloseHandle
GetModuleHandleA
GetSystemInfo
VirtualProtect
GetLocaleInfoA
OpenMutexA
CreateFileA
FlushFileBuffers
RtlUnwind
ExitProcess
GetStringTypeW
ResetEvent
GetStringTypeA
GetStartupInfoA
GetCommandLineA
GetVersionExA
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
HeapAlloc
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
SetEndOfFile
ReadFile
SetFilePointer
SetStdHandle
HeapSize
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
VirtualQuery
user32
ShowWindow
FindWindowA
gdi32
CreateCompatibleDC
psapi
GetProcessMemoryInfo
avifil32
AVIFileInit
msvfw32
DrawDibClose
Sections
.text Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ