K:\lZslMwgcfpmzq\qBZgvnYea\sZlyuOT.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2fee0259bd7ef86acea62050c37c9380_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2fee0259bd7ef86acea62050c37c9380_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2fee0259bd7ef86acea62050c37c9380_JaffaCakes118
-
Size
168KB
-
MD5
2fee0259bd7ef86acea62050c37c9380
-
SHA1
65d72a1dc03cd50d591cae527540841206e0e9b0
-
SHA256
7b9498e40d03dc5fe008f8f9a210129c469f9fe3e59a5645df91cf75d126c70a
-
SHA512
fd387abf2d2a8a96ba09a9eb55b6fade7783e1607aa5ad25e09b50e94cc2362c58a5bc5e9fac133f6af8e9169596d94505bf728e750897a55563ec29076e5681
-
SSDEEP
3072:V2O5tCdFhi79UFeKJUB+CH384McsfJ68qlwrawla9bMCMkU/ske3m:f5Uq5KKB+CHBCfJNqulOIClU6m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2fee0259bd7ef86acea62050c37c9380_JaffaCakes118
Files
-
2fee0259bd7ef86acea62050c37c9380_JaffaCakes118.exe windows:5 windows x86 arch:x86
3ae07eb1d30f6fd841927a1f7afc7539
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
DrawTextA
GetSubMenu
MapVirtualKeyW
MessageBoxExW
CharToOemW
DestroyCaret
DestroyMenu
CharPrevA
GetUpdateRgn
DispatchMessageA
IsRectEmpty
ScrollWindow
SetLastErrorEx
LoadAcceleratorsW
FillRect
SetActiveWindow
EnableScrollBar
DragObject
GetMonitorInfoW
SetUserObjectInformationW
CharLowerBuffW
FindWindowExA
MapVirtualKeyA
ToUnicodeEx
CreateDialogParamW
IsZoomed
DrawTextExW
DrawEdge
LockWindowUpdate
RemoveMenu
GetDlgCtrlID
SetRect
SendMessageTimeoutA
GetScrollPos
ChildWindowFromPointEx
CopyAcceleratorTableW
GetWindowTextLengthW
GetWindowLongA
GetClassLongW
SetTimer
GetClassInfoExA
KillTimer
GetMenuStringA
LoadIconA
msvcrt
_controlfp
setvbuf
__set_app_type
fgetc
__p__fmode
__p__commode
isalpha
_amsg_exit
_initterm
_acmdln
gets
exit
_ismbblead
_XcptFilter
strncmp
atoi
_exit
_cexit
vswprintf
__setusermatherr
__getmainargs
realloc
srand
strtok
fwrite
wcstod
kernel32
FileTimeToLocalFileTime
ReleaseMutex
GetAtomNameW
GetFileSize
lstrcpyA
SetThreadExecutionState
ExitProcess
GetThreadTimes
GetModuleFileNameW
GlobalHandle
GetCommandLineW
TryEnterCriticalSection
SetThreadContext
CreateNamedPipeA
GlobalCompact
GetCommandLineA
GetTempPathA
LocalReAlloc
ReleaseSemaphore
CreateThread
ExitThread
AddAtomA
comdlg32
ChooseFontW
GetSaveFileNameA
shlwapi
StrToIntW
IntlStrEqWorkerA
PathRemoveBlanksW
ChrCmpIA
StrToInt64ExA
gdi32
CreateDIBSection
Rectangle
CreateDiscardableBitmap
PathToRegion
SetROP2
GetTextExtentPointW
GetPaletteEntries
SetPaletteEntries
ExcludeClipRect
SetRectRgn
SetBkColor
SetDIBColorTable
SetBitmapBits
CreatePatternBrush
CreatePolygonRgn
RemoveFontResourceW
TextOutW
SetLayout
SetAbortProc
Exports
Exports
?HideStateOld@@YGPAJPAJ&U
?IncrementDirectoryExW@@YGPAMPAMHHI&U
?DeleteListItemExA@@YGMPANF&U
?AddWindowInfoExA@@YGGPA_NJG&U
?IsNotPenExW@@YGPADJ&U
?CopyTimeOld@@YGED&U
?IsConfig@@YGJPAJHPANPAF&U
?IsValidPointEx@@YGXIPAFM&U
?RtlWidthEx@@YGHNFDK&U
?InsertPointOriginal@@YGEG&U
?DeleteFolderPathOriginal@@YGXJKD&U
?IsValidProfileExA@@YGPAJG&U
?LoadAppNameOld@@YGIPAHDPAJPAE&U
?InsertMainStructDlhSi@@YGKGH@Z
?LoadPathExA@@YGMGHPA_NPA_N&U
?IsNotSemaphoreExW@@YGPAGPA_NPAK&U
?ModifyVersionExA@@YGKJPAM&U
?InstallDeviceEx@@YGPAFHHPAIPAF&U
?DecrementComponentA@@YGPAXH&U
?InsertClassExA@@YGJFPAHDPAH&U
?ValidateWindowInfoExA@@YGXK&U
?CallModuleA@@YGPA_NHM&U
?AddFilePathA@@YGPAIPAIDPAH&U
?CallMessageA@@YGPAJMFHH&U
?FormatFolderPath@@YGPAKJIE&U
?RemoveDate@@YGK_NGI&U
?CallDateA@@YGMPAEJM&U
?GlobalSystemOld@@YGIPAN&U
?LoadTimerExW@@YGMJEHK&U
?GenerateText@@YGFNM&U
?GenerateNameExW@@YGFNPAJ&U
?InstallKeyNameOld@@YGPAENPAM&U
?GlobalSectionExA@@YGXPAKE&U
?FindSystem@@YGXHK&U
?IsAppNameA@@YGXPANGJ&U
?OnPenA@@YGPAFJPAJ&U
?ShowTimeExA@@YGGDFF&U
?OnNameEx@@YGJDPAI&U
?SetOptionOriginal@@YGHPAE_N&U
?CloseComponent@@YGMPANEPAM&U
?RtlDateTime@@YGXDG&U
?SendConfigExW@@YGPAKI&U
?ShowMediaTypeOld@@YGPAJDHJ&U
?ValidateArgumentExW@@YGMJPAKPAJI&U
?RtlWindowW@@YG_NPAMJD&U
?OnDeviceA@@YGPADPAMNPAG&U
?InstallProcessEx@@YGGMI&U
?RemoveHeaderOriginal@@YGPAKM&U
?SendSemaphoreW@@YGJPAE&U
?InstallProjectOld@@YGXKPAHFM&U
?SendAnchorA@@YGFPADGEH&U
?RemoveScreenNew@@YGPAJPAF&U
?ValidateSemaphoreOriginal@@YGJPAH&U
?SendSizeA@@YGEHG_N&U
?EnumWidthW@@YGXI&U
?CallProviderNew@@YGKHPAFN&U
?SendPenW@@YGEPAHPAFMI&U
?EnumKeyboard@@YGPADM&U
?FindVersionOld@@YGPADIPAF&U
?DecrementArgumentOriginal@@YGXE&U
?DeleteSystemEx@@YGNPAJ&U
?FreeMutexEx@@YGPADH&U
?IncrementFileOriginal@@YGFPAH_NDPA_N&U
?SetAnchorW@@YGXGPAGPAI&U
?PutObjectW@@YGEIPAK&U
?CrtDirectoryW@@YGKFPANG&U
?StateW@@YGMEG&U
?CloseNameOriginal@@YGXIF&U
?GenerateKeyboardA@@YGIPAFF&U
?ShowDialogA@@YGPAJPA_NDG&U
?FreeComponentEx@@YGDPAI&U
?CopyFolderW@@YGPAMHIGPAM&U
?CancelMonitorW@@YGPANK&U
?CallClassOld@@YGDPAE&U
?SetPointOld@@YGJID&U
?InstallMonitorEx@@YGPAXPAIPADMJ&U
?AddKeyboardEx@@YGXEPAINPAF&U
?EnumProjectExA@@YGNJPAJ&U
?ValidateThreadOriginal@@YGPAIPAN_NH&U
?IncrementMemoryNew@@YGXPAHDG&U
?ModifyWindowInfoA@@YGJIMPADG&U
?CancelFunctionW@@YGJI&U
?FreeFileExA@@YGPAGFEJK&U
?OnDateTimeExW@@YGEIK&U
?PutCommandLineEx@@YGEI&U
?PutKeyName@@YGFGGG&U
?DecrementWidthOriginal@@YGXFPAI&U
?ShowWidthOriginal@@YGPADPAFPAJPAG&U
?OnDialogW@@YGGPAH&U
?HideListEx@@YGGE&U
?OnTaskA@@YGXGI&U
?ModifyTaskOld@@YGPADEIPAMPAJ&U
?FindAppNameExA@@YGPAMKPA_N&U
?AddProcess@@YGXJE&U
?OnMediaTypeA@@YGPAXMPAFFPAJ&U
?CloseFullName@@YGPANPAM&U
?AddDateTimeA@@YGPAHGPAH&U
?CopyDialogOld@@YGIJPAHE&U
?KillStringW@@YGPAEDPAHHPAE&U
?IsValidConfigOriginal@@YGJNGPAHF&U
?InstallProjectEx@@YGEPAJ&U
?HideExpressionOriginal@@YGHJPAJH&U
?DecrementMemoryOld@@YGMNPAMPAJF&U
?LoadFilePath@@YGKPAMGPAG&U
?RtlAppNameOriginal@@YGDPAKMPAF&U
?InsertListItemOld@@YGPAEPAGPAED&U
?FindFunctionExA@@YGPAEGG&U
?ShowFullNameExW@@YGJPAKHMPAN&U
?EnumMessageNew@@YGKKDJPAD&U
?FreeWindowA@@YGMG&U
?GlobalListOriginal@@YGEI&U
?InsertWindowInfoOld@@YGJPAF_NPAKPA_N&U
?OnMonitorEx@@YGHED&U
?DecrementProviderExA@@YGPAX_N&U
?InsertDateOriginal@@YGXPAEPAE&U
?CancelDirectoryOld@@YGIPAFPAFJ&U
?RtlTimerNew@@YGKMPAHPADI&U
?CallOptionExW@@YGPAGKDPAF&U
?IsNotExpressionNew@@YGMJEN&U
?ModifyPathEx@@YGPADNDPAK&U
?FormatCharA@@YGI_NPAGM&U
?SetWindowInfoOriginal@@YGFFEPAE&U
?RemovePathExA@@YGPAHFKJPAH&U
?CrtAnchorA@@YGFKPAJGJ&U
?ValidateMessageEx@@YGPAKPAIDPAM&U
?IsNotWindow@@YGPAXPAD&U
?CloseMemoryOld@@YGPANE&U
?LoadMessageEx@@YGPAMPAHPAED&U
?InsertMutantExW@@YGPAXPAIKEI&U
?InsertDevice@@YGXPAJ&U
?IncrementMutexEx@@YGXMDGG&U
?FormatProfileNew@@YGN_N&U
?SetClass@@YGPADPAEJK&U
?RtlVersionExW@@YGFPAGPAF&U
?ShowStateExW@@YGXKPAE&U
?IsListItemExA@@YGPAEJPA_NPAH&U
?GlobalVersionEx@@YGPAXFJI&U
?CommandLineExW@@YGPAIPADD&U
?SetAppNameOriginal@@YGHMGD&U
?HidePenExW@@YGXIDPAGF&U
?LoadDataExW@@YGKM&U
?DecrementFunctionW@@YGPAKFIHPAN&U
?RtlCommandLineNew@@YGHKPAKE&U
?HideListItemExA@@YGKEJJ&U
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rimp Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.redt Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdbg1 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rit Size: 1024B - Virtual size: 528B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdbg2 Size: 512B - Virtual size: 63B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rvar Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rpt Size: 512B - Virtual size: 452B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hdata Size: 1024B - Virtual size: 720B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ping Size: - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ