H:\D\Misha\bho\runexpl\runexpl\Release\smphost.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3e1ee892a4b42c997153b21595245210_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3e1ee892a4b42c997153b21595245210_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3e1ee892a4b42c997153b21595245210_JaffaCakes118
-
Size
345KB
-
MD5
3e1ee892a4b42c997153b21595245210
-
SHA1
4f52e0ef733f775f8b065d44b7e327a0dd05b143
-
SHA256
1f824865b53d0c43ec206aec04db3ba86dc9f64cef6b6714173377845ccb9ec1
-
SHA512
7ddfac0a694df00e810e3e138270866301de8316221ed2aa3cd62b07174b8909886245a0aa8f3a0d8172758edbcdbcf071c744993fb0cd3e281d3b8b3f45e096
-
SSDEEP
6144:DSe2m4aqjnOzdLK6r84fFBLXFOi03FAWH2mjYeje6MVbpu:2e2m4P0LKo8YTFOikFbYO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e1ee892a4b42c997153b21595245210_JaffaCakes118
Files
-
3e1ee892a4b42c997153b21595245210_JaffaCakes118.exe windows:5 windows x86 arch:x86
f70fdef3f43f81fc511079f993a28f03
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
psapi
GetProcessImageFileNameW
GetModuleFileNameExW
kernel32
Sleep
GetSystemInfo
SetProcessAffinityMask
CreateToolhelp32Snapshot
Thread32First
GetLastError
Thread32Next
LocalFree
CreateFileW
GetFileSize
ReadFile
WriteFile
OpenSemaphoreW
WaitForSingleObject
CreateProcessA
ReleaseSemaphore
GetModuleFileNameW
CreateProcessW
OpenProcess
CreateEventW
CancelIo
GetOverlappedResult
CreateNamedPipeA
DisconnectNamedPipe
ConnectNamedPipe
SetEvent
GetVersionExA
GetTickCount
MultiByteToWideChar
TerminateThread
SetThreadPriority
GetExitCodeThread
ResumeThread
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
SetEndOfFile
SetFilePointer
GetLocaleInfoW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
CreateFileA
LCMapStringW
WideCharToMultiByte
LCMapStringA
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentProcess
GetPriorityClass
CloseHandle
CreateSemaphoreW
HeapFree
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapAlloc
InterlockedIncrement
InterlockedDecrement
ExitThread
GetCurrentThreadId
CreateThread
GetStartupInfoW
RaiseException
RtlUnwind
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
user32
CharLowerW
GetParent
GetWindowInfo
SetWindowPos
SystemParametersInfoW
GetWindowPlacement
EnumWindows
FindWindowExW
GetWindowThreadProcessId
EnumThreadWindows
IsWindow
PostMessageW
SendMessageW
GetWindowRect
GetKeyState
EnumChildWindows
GetWindowTextW
GetClassNameW
advapi32
InitializeSecurityDescriptor
GetUserNameW
RegSetValueExW
RegCreateKeyExW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
ws2_32
WSACleanup
gethostbyname
WSAStartup
Sections
.text Size: 255KB - Virtual size: 254KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ