EarthFa.pdb
Static task
static1
Behavioral task
behavioral1
Sample
130360c790305d256d3ebf0191269664_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
130360c790305d256d3ebf0191269664_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
130360c790305d256d3ebf0191269664_JaffaCakes118
-
Size
528KB
-
MD5
130360c790305d256d3ebf0191269664
-
SHA1
d2ae80f2e784fdce66fa2167c62fa0b1143afa08
-
SHA256
4510261d0831bcf78db1dffce3d0e97a4cba4218ee12393f309e512248f30456
-
SHA512
59bad8b79f1a6cb3fb0c6dbe734f1d23f9d4caaf32b6fcfb2fd559bcd74283c6ca4c24f860241819196bf42f40e005acbbb3365e718aa1a61a95c9f36c7a0aeb
-
SSDEEP
6144:Qu44cUpU8o8iJoV0yIRXMXP6dayYm66xug9qw/bkGrdZUlTAYHH8PlrDMo0:Qu4SpUTMAXBSm66Z9qw/IqZeh8VR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 130360c790305d256d3ebf0191269664_JaffaCakes118
Files
-
130360c790305d256d3ebf0191269664_JaffaCakes118.exe windows:4 windows x86 arch:x86
42a371df5fe386c07d988f3ba921f1c2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLastError
GetLocaleInfoA
CreateFileA
FindAtomA
SetCurrentDirectoryA
GetTempPathA
WaitForSingleObject
CreateThread
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 476KB - Virtual size: 858KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 623B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ