C:\codes-svn\Sophia\Release\Sophia.pdb
Static task
static1
Behavioral task
behavioral1
Sample
500b2c927713d8577a3e1e7a55123a3c_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
500b2c927713d8577a3e1e7a55123a3c_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
500b2c927713d8577a3e1e7a55123a3c_JaffaCakes118
-
Size
194KB
-
MD5
500b2c927713d8577a3e1e7a55123a3c
-
SHA1
c06a6ee3b009e910a56571334924b084f5ab7ac6
-
SHA256
1db938561f06adbe8fe35c140f9e834924bf99357a002166bc91a6de8ca46f9d
-
SHA512
1dd9eafe697cace9bae306bbd765aa0b23a14237de8133ed2401d2bccb699059ec146daf46d5aec2d32d60e7d50c5740bf4b9ca994fc1b0a88578881637c5dee
-
SSDEEP
1536:iemSTpI20clBAXu42VFgmoxsJA2krXlbpPCq1YhV5cRw3lau2lN5jazzOlfQkHRZ:nDTguSe4H2Al1EhV5cReauYqW5MzYp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 500b2c927713d8577a3e1e7a55123a3c_JaffaCakes118
Files
-
500b2c927713d8577a3e1e7a55123a3c_JaffaCakes118.exe windows:5 windows x86 arch:x86
30e4b792b6b8ae5a334a9c9fb4ac52af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
wininet
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
InternetQueryDataAvailable
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
kernel32
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetModuleHandleA
LoadLibraryA
GetProcAddress
CreateToolhelp32Snapshot
Module32First
Module32Next
GetProcessId
ExitProcess
GetCurrentThread
GetLastError
GetCurrentProcess
LocalAlloc
LocalFree
OpenMutexA
CreateMutexA
CreateThread
GetModuleFileNameA
GetWindowsDirectoryA
CopyFileA
Process32First
Process32Next
DeviceIoControl
CloseHandle
WriteFile
CreateFileA
GetVolumeInformationA
GetVersionExA
GetComputerNameA
GetTempFileNameA
GetTempPathA
Sleep
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
WaitForSingleObject
HeapAlloc
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
advapi32
FreeSid
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
DuplicateToken
OpenProcessToken
OpenThreadToken
RegCloseKey
RegSetValueExA
RegCreateKeyExA
GetUserNameA
RegOpenKeyExA
shell32
ShellExecuteA
Sections
.text Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 73KB - Virtual size: 209KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ