D:\Source\branches\phoenix\containers\CdAgWin\Debug\CdAgWin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5278f29f31c750632f193c447b1c04df_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5278f29f31c750632f193c447b1c04df_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
5278f29f31c750632f193c447b1c04df_JaffaCakes118
-
Size
1000KB
-
MD5
5278f29f31c750632f193c447b1c04df
-
SHA1
d0890cdb9fc2e48c040f34a40b79bddeaf2f6ab9
-
SHA256
9ee151468bc16a3e1039406eaf1d28154f49931bc6ea26ca31a273d0d52f9b7b
-
SHA512
5d7d6b2f698c2fc7fe89a7195e16ca6ce899c8f1f922b04a489b6286fed4226a5c81345ca10be2c29e784c467a69652daa623207a2484e53f8aac26b781049e0
-
SSDEEP
12288:uHQ5xB3rIJNBBRJ71FnlmFvC8uZMQzlyX/ZIscde1sBpHLrKLm7fDISoK:mQHFIzRHFn9/ZLUX/Z3wpHL7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5278f29f31c750632f193c447b1c04df_JaffaCakes118
Files
-
5278f29f31c750632f193c447b1c04df_JaffaCakes118.exe windows:5 windows x86 arch:x86
05d1c5fbd768855a50616bccf36e5725
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCurrentProcessId
TryEnterCriticalSection
InitializeCriticalSection
GetLastError
GetModuleFileNameW
RaiseException
EnterCriticalSection
CloseHandle
GetCurrentProcess
GetCurrentThreadId
GetProcAddress
LoadLibraryA
CreateFileW
ExpandEnvironmentStringsW
FreeLibrary
WriteFile
GetStdHandle
OutputDebugStringA
FormatMessageA
HeapSetInformation
GetStartupInfoW
GetSystemTimeAsFileTime
RtlUnwind
DecodePointer
EncodePointer
IsDebuggerPresent
MultiByteToWideChar
lstrlenA
LoadLibraryW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
InterlockedIncrement
InterlockedDecrement
GetModuleHandleW
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapValidate
LeaveCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
HeapCreate
HeapDestroy
FatalAppExitA
TerminateProcess
UnhandledExceptionFilter
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
IsProcessorFeaturePresent
GetLocaleInfoW
WriteConsoleW
OutputDebugStringW
SetConsoleCtrlHandler
HeapFree
HeapAlloc
GetProcessHeap
VirtualQuery
GetModuleFileNameA
InterlockedExchange
HeapReAlloc
HeapSize
HeapQueryInformation
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
LCMapStringW
GetStringTypeW
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
SetEndOfFile
ReadFile
GetCommandLineW
WideCharToMultiByte
GlobalAlloc
lstrcmpiA
LocalFree
IsBadReadPtr
CreateThread
WaitForSingleObject
CreateEventW
SetEvent
DebugBreak
lstrcpynW
GetCurrentDirectoryW
Sleep
InterlockedCompareExchange
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileExW
FindNextFileW
FindFirstFileExA
FindNextFileA
GetFullPathNameW
GetFileInformationByHandle
PeekNamedPipe
SetCurrentDirectoryW
GetFullPathNameA
GetTimeZoneInformation
CreateFileA
CompareStringW
SetEnvironmentVariableA
GetExitCodeThread
GlobalFree
user32
SetLayeredWindowAttributes
LoadIconW
EnumDisplayMonitors
GetClientRect
UnionRect
LoadCursorW
RegisterClassExW
SetWindowLongW
BeginPaint
GetWindowLongW
EndPaint
GetClassLongW
GetMonitorInfoW
DispatchMessageW
TranslateMessage
MessageBoxW
wsprintfA
DestroyIcon
GetSystemMetrics
CloseWindow
GetWindowRect
IntersectRect
FillRect
CreateWindowExA
GetMessageW
PostQuitMessage
DefWindowProcW
PostMessageW
RedrawWindow
FindWindowExW
InvalidateRect
TranslateAcceleratorW
shell32
CommandLineToArgvW
Shell_NotifyIconW
ExtractIconW
oleaut32
DispInvoke
DispGetIDsOfNames
LoadTypeLibEx
VarCmp
VariantChangeType
VarAdd
VariantCopy
SysAllocString
SysFreeString
SysAllocStringLen
VARIANT_UserSize
VARIANT_UserMarshal
VARIANT_UserUnmarshal
VARIANT_UserFree
gdi32
CreateSolidBrush
GetDeviceCaps
DeleteDC
CreateICA
DeleteObject
ole32
CoCreateInstance
StringFromIID
CoTaskMemFree
CoInitialize
OleSetContainedObject
rpcrt4
NdrServerCall2
RpcBindingFree
RpcStringBindingComposeA
RpcBindingFromStringBindingA
RpcEpResolveBinding
RpcMgmtIsServerListening
RpcStringFreeA
NdrClientCall2
RpcMgmtStopServerListening
RpcServerListen
RpcServerUseProtseqEpA
RpcServerRegisterIf
Sections
.textbss Size: - Virtual size: 378KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 798KB - Virtual size: 797KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 144KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ