msmsgs.pdb
Static task
static1
Behavioral task
behavioral1
Sample
26873e9345ab9c91520e54ace4e6fb83_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
26873e9345ab9c91520e54ace4e6fb83_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
26873e9345ab9c91520e54ace4e6fb83_JaffaCakes118
-
Size
167KB
-
MD5
26873e9345ab9c91520e54ace4e6fb83
-
SHA1
b8b4fedb2f9850f6562c66b7b2b4ab03172ab19d
-
SHA256
1f7ca95a24ee5c5f5b4d5a6d7863c03f1891208e6adc75a9128c6f9bacbda6ea
-
SHA512
38305ce51daefc093d67cbd7fce575fcf131f01c182c529c7d09e5362a1e4e008ae685067bae3abda92d3ab53e7159e6bc2cc5b51f8b7f60a0f244dfb4a389cb
-
SSDEEP
3072:ObUYUrsycfoLqMP+sEy7AWrqM5C1/owp9mH1HWYS9loQth3RnIQdKHlCNSg3w:EUYUrBcf7MP+sIws1781rOrthOHliSgA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26873e9345ab9c91520e54ace4e6fb83_JaffaCakes118
Files
-
26873e9345ab9c91520e54ace4e6fb83_JaffaCakes118.exe windows:5 windows x86 arch:x86
6b184f8e56f442de787ac8f28ef2ff2a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
setupapi
SetupDiDeleteDeviceInterfaceRegKey
CM_Disconnect_Machine
SetupScanFileQueueW
SetupOpenFileQueue
SetupFindFirstLineW
SetupDiSetSelectedDriverW
SetupDiSetDeviceRegistryPropertyW
SetupDiSetDeviceInstallParamsW
SetupDiSetClassInstallParamsW
SetupDiSelectDevice
SetupDiOpenDeviceInfoW
SetupDiOpenDevRegKey
SetupDiOpenClassRegKeyExW
SetupDiInstallDeviceInterfaces
SetupDiGetINFClassW
SetupDiGetDriverInstallParamsW
SetupDiGetDriverInfoDetailW
SetupDiGetDeviceInstallParamsW
SetupDiGetDeviceInfoListDetailW
SetupDiGetClassDevsExW
SetupDiGetClassDescriptionExW
SetupDiEnumDriverInfoW
SetupDiEnumDeviceInfo
SetupDiDestroyDriverInfoList
SetupDiDestroyDeviceInfoList
CM_Connect_MachineW
SetupDiCreateDeviceInfoW
SetupDiCreateDeviceInfoList
SetupDiClassNameFromGuidExW
SetupDiClassGuidsFromNameExW
SetupDiCallClassInstaller
SetupDiBuildDriverInfoList
SetupDiBuildClassInfoListExW
SetupCopyOEMInfW
SetupCloseInfFile
SetupCloseFileQueue
CM_Enumerate_Classes
CM_Free_Res_Des_Handle
CM_Get_DevNode_Status_Ex
CM_Get_Device_ID_ExW
CM_Reenumerate_DevNode_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Res_Des_Data_Size
CM_Get_Next_Res_Des_Ex
CM_Get_First_Log_Conf_Ex
ole32
CLSIDFromString
kernel32
lstrlenW
VirtualProtect
VirtualFree
VirtualAlloc
UnhandledExceptionFilter
TerminateProcess
Sleep
SetUnhandledExceptionFilter
RtlUnwind
QueryPerformanceCounter
LocalFree
LoadLibraryW
InterlockedExchange
InterlockedCompareExchange
GetWindowsDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
GetLastError
GetFullPathNameW
GetFileAttributesW
GetDateFormatW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
FreeLibrary
FormatMessageW
FindNextFileW
FindFirstFileW
CloseHandle
ExitProcess
FileTimeToSystemTime
FindClose
shell32
SHGetFolderPathW
SHEmptyRecycleBinA
DragQueryFileAorW
advapi32
RegSetValueExW
RegDeleteValueW
RegCloseKey
OpenServiceW
OpenSCManagerW
OpenProcessToken
LsaClearAuditLog
LookupPrivilegeValueW
InitiateSystemShutdownExW
CloseServiceHandle
msvcrt
_XcptFilter
__p__commode
__p__fmode
__set_app_type
__setusermatherr
__wgetmainargs
_controlfp
_exit
_initterm
_mkdir
_pwctype
_vsnwprintf
_wcsicmp
_wcsnicmp
_wexecle
exit
fputs
fscanf
getwc
iswalpha
memset
towupper
wcschr
wcsrchr
user32
CharPrevW
LoadStringW
CharNextW
Exports
Exports
AAuxOpen
BindContext
PszSkipWhiteA
UlStripWhitespaceW
Sections
.text Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 89KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ