F:\ZL\2010\sExe\Debug\sExe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
161928f53a2640942d0c2395c9315c12_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
161928f53a2640942d0c2395c9315c12_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
161928f53a2640942d0c2395c9315c12_JaffaCakes118
-
Size
274KB
-
MD5
161928f53a2640942d0c2395c9315c12
-
SHA1
c7c1ae0007a80ac6377da8475b57d4dc573bc51b
-
SHA256
87ba46913e81a0a811473f29ac4fdb5a039234874a6d109f29ae3c1786f731c2
-
SHA512
3a856c9b8a40a591ce2ece7c5011139772672b9528a36cd9e0897af0f3848d977dfea0b99cb68ad1c402ed788e4fb74c85a5ae52541de702793c03d1563e21fb
-
SSDEEP
6144:jm+jwwwwwwwwwwwwwwwwwwww8wwwwewwwwwwwwwwwwwwwwwwwwww5wwwwwwwwwwO:y+jwwwwwwwwwwwwwwwwwwww8wwwwewwX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 161928f53a2640942d0c2395c9315c12_JaffaCakes118
Files
-
161928f53a2640942d0c2395c9315c12_JaffaCakes118.exe windows:5 windows x86 arch:x86
83e5d2f4c751b8760f48667204d8d967
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetFileSize
OpenFile
GetModuleFileNameA
HeapFree
lstrlenA
lstrcatA
lstrcpyA
lstrcmpW
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleW
ExitProcess
CreateMutexW
GetModuleFileNameW
FreeLibrary
GetSystemTimeAsFileTime
GetProcessHeap
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
LoadLibraryW
GetProcAddress
MultiByteToWideChar
IsDebuggerPresent
WideCharToMultiByte
RaiseException
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
HeapAlloc
ReadFile
OpenProcess
SuspendThread
GetSystemInfo
CloseHandle
VirtualQueryEx
ReadProcessMemory
lstrlenW
lstrcpyW
ResumeThread
GetCurrentProcess
GetLastError
GetCurrentProcessId
VirtualQuery
user32
ReleaseDC
SetTimer
UpdateWindow
SetForegroundWindow
ShowWindow
SendMessageW
SetWindowTextW
SendMessageA
LoadIconA
LoadCursorA
DispatchMessageA
TranslateMessage
GetMessageA
RegisterClassW
SetWindowRgn
GetWindowTextA
SetWindowTextA
DefWindowProcA
CreateWindowExA
CreateWindowExW
SetWindowLongA
CallWindowProcA
GetDC
GetForegroundWindow
GetClassNameW
FindWindowExW
GetWindowThreadProcessId
MoveWindow
gdi32
DeleteDC
SelectObject
CreateDIBitmap
CreateCompatibleDC
GetObjectA
CreateFontIndirectA
BitBlt
GetDeviceCaps
CreateRoundRectRgn
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
ws2_32
sendto
htons
inet_addr
WSACleanup
socket
WSAStartup
closesocket
msvcr100
_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
memcmp
memset
memcpy
??2@YAPAXI@Z
_CRT_RTC_INITW
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
Sections
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 222KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ