EvCreate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
27f71d8bd079c46c7e6ae38d9be52880_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
27f71d8bd079c46c7e6ae38d9be52880_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
27f71d8bd079c46c7e6ae38d9be52880_JaffaCakes118
-
Size
51KB
-
MD5
27f71d8bd079c46c7e6ae38d9be52880
-
SHA1
b0cef21762630e136f2b3a37b6a9937abc9bc467
-
SHA256
896688a9283238f74db693d0f1ba45b58a2906bb233591ce7af00c11f14f3144
-
SHA512
1758ed84d5d20552928bbe0a625745907e78e3593fad0f8db81903a3acd1319fe9abb2fe5f0cef59e5e1440cf4b86bc867d5b35849a63db8c30d901c15486c8c
-
SSDEEP
768:1HBdDhZ9MgeQ4srZfZuPZMCgVXGoWwBtNjxmjpMZ4+x:tDr9MzQ4srZR6ZvgVX2wdjxmjpMm+x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 27f71d8bd079c46c7e6ae38d9be52880_JaffaCakes118
Files
-
27f71d8bd079c46c7e6ae38d9be52880_JaffaCakes118.exe windows:5 windows x86 arch:x86
fd9c9502ed4db9717167c65abaf39f81
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_controlfp
wcstod
wcstol
wcsstr
wcsncmp
_wcsnicmp
realloc
fflush
fprintf
wcschr
wcstok
strtok
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
swprintf
_iob
_wcsdup
calloc
free
advapi32
OpenEventLogW
ReportEventW
DeregisterEventSource
CloseEventLog
RegConnectRegistryW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegisterEventSourceW
kernel32
GetProcAddress
FreeLibrary
lstrcpynW
WideCharToMultiByte
LoadLibraryW
VerifyVersionInfoW
GetModuleHandleA
GetComputerNameExW
UnhandledExceptionFilter
LocalFree
FormatMessageW
MultiByteToWideChar
ReadConsoleW
ReadFile
WriteConsoleW
SetConsoleMode
GetConsoleMode
GetStdHandle
VerSetConditionMask
SetUnhandledExceptionFilter
lstrcpyW
SetLastError
lstrlenW
lstrcmpW
lstrcatW
lstrcmpiW
GetLastError
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
user32
wsprintfW
CharUpperW
LoadStringW
mpr
WNetGetLastErrorW
WNetCancelConnection2W
WNetAddConnection2W
secur32
GetUserNameExW
ws2_32
WSACleanup
gethostbyaddr
inet_addr
WSAGetLastError
WSAStartup
netapi32
NetApiBufferFree
NetServerGetInfo
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 21B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
XOR Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE