I:\Master\Slack\reffer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
aea1554a579f8a210384e6e0be4d4040_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
aea1554a579f8a210384e6e0be4d4040_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
aea1554a579f8a210384e6e0be4d4040_JaffaCakes118
-
Size
96KB
-
MD5
aea1554a579f8a210384e6e0be4d4040
-
SHA1
2dc9c2f0ed71b81efc6cfa2cbce8dae248a0cce9
-
SHA256
73aa7c2d5be43317e485ff28ec208cdd0ddc4425df52e97ee0d4139416d29e10
-
SHA512
558f89e8a0dd23232d1eaf4a1b01c1f45d350b5c4ce82802e0612b283842073d61b9f8d64c15028f201e32fad6ad8ec23b11438ff56653d51b7acb33522962c1
-
SSDEEP
3072:5lSdTEqSxqwuWNS9+m69MFtJo8egbxkK:5l4TDkN4tJB3dkK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aea1554a579f8a210384e6e0be4d4040_JaffaCakes118
Files
-
aea1554a579f8a210384e6e0be4d4040_JaffaCakes118.exe windows:11 windows x86 arch:x86
29a44843ee0beb8837ecd5b5f0799036
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
DestroyAcceleratorTable
MapDialogRect
shlwapi
StrCatChainW
StrCmpLogicalW
ChrCmpIW
ord29
UrlIsOpaqueW
UrlGetPartA
kernel32
lstrcpyA
GetProfileSectionW
Exports
Exports
?ModifyKeyNameExWPAEPAJPAIPAK
?RtlMessageOldPAE_NDMK
?GenerateWidthWPADIHEH
?ValidateClassPAFKPADNPAI
?RemoveProfileOriginalXPAMPAI
?InvalidateListItemW_ND
?RemoveProfilePAJIKPADM
?CrtFolderPathNewFE
?CrtStateW_NJJ
?DecrementMemoryOldPAFFPAIPADPAF
?InsertVersionNewXIH
?RemoveTimerFDPAK
?InsertThreadAJK
?FormatWindowExAPAKDH
?RemoveKeyboardExAFHPAFNPAK
?FindObjectOldPADDPAD
?SendDialogExAPAXD
?ShowFunctionOldEPAHPAK
?RemoveTaskExWPAFPAJPAJGK
?FindAppNameExAF_NPAIGPAE
?FreeTextExWPAGDEF
?InvalidateStringExAXPAHHPAG
?HideEventExWHKPAI
?RtlFolderPathExAJPAD
?OnTextKGPAH
?DeleteCommandLinePAHPAJ
?RtlFolderWPADGFPAJE
?IsNotMemoryExAKHFEPA_N
?CopyValueAKK
?IsNotHeaderExAXN
?InvalidateKeyNameExWEI
?CloseEventExJJHJPAG
?EnumCommandLineAXE
?ModifyValueOriginalXJDPAN
?IsSizeExPAJ_N
?DecrementSizeExAPAKPAHPADI
?FreeNameNewPAJPAD
?InsertMessageExWXPAG
?ValidateProjectExAFIJPAKG
?FreeListExAGPAHPAGI
?InsertTaskAPA_NFPAFG
?InstallNameAEINE
?IsObjectOldPAEPAHIPAHI
?ValidateMonitorOldDMDM
?FreeProfileOldFHM
?FreeStateWI_NFPAKM
?CloseProjectWXPAM_NPADI
?FindSystemExWPANE
?GetSectionNewGPAFEHPAE
?AddWindowExKPAEPAJME
?CrtPathWKE
?InstallAppNameNewI_NM
?EnumWindowExPAKPAGHPA_NPAJ
?GetListItemDPADPA_NGF
?FreeProfileNewPAJPAHG
?IncrementEventOldPAEEI
?SetSystemExADHFME
?HideNameAPAXIPAMG
?EnumKeyboardWPAIDD
?FreeSizeExWXEPADM
?RemoveTextW_NGPAHJM
?PutTaskOldXD
?IsValidNameOriginalHDPAE
?FormatRectAPADMPAEJE
?CrtDeviceOldPAFG
?ShowSizeExWPAFEMNK
?GenerateWidthAFPAEPAM
?IsExpressionExWPAMPAIPAE
?HideComponentExEPAJPAD
?DeleteNameExPAFPAE
?FormatDateExAMFGED
?DeleteStringOriginalMNPAIPAM
?CallKeyNameEKPAEH_N
?GlobalListOldXI
?IsValidVersionOriginalPADPAJ
?KillHeightAPAIJ
?CloseStateExGPAJ
?CloseRectOldFF
?ShowFolderPathExPAGEPAD
?GenerateAppNameExAPAKPAKIFPAH
?IsValidStringExX_NPAEH
?IncrementTimerNewXDK
?CancelSemaphoreOldPANMMPA_NK
?FormatCommandLineOldXPAMNMPAG
?IsPathWJJPAEGPA_N
?FreeDirectoryPAHPAFPAM
?IsValidValueExAIPAFE
?KillThreadAJK
?IncrementStateOriginalPAFKM
?GlobalHeightExAXNGPAIG
?CopyKeyboardXPAFPAHFPAM
?GlobalDateAKJPADPAJ
?CallComponentExWMHPAJPAFN
?ValidateAppNameExIH
?InsertSystemOldPAJK
?FreeWindowInfoNewE_NIE
?CrtFullNameADPAEMPAMM
?InsertSystemNewMHJ
?CrtMessageAPAJPADFN
?GlobalProjectNewKPAEHK
?InvalidateFunctionOldH_NNPAHPAJ
?OnMutexAJPAJD
?PutSemaphoreOldDGHPAE
?ShowAnchorOldPAXPAF
?CrtKeyNameOriginalPAFPAFGDD
?FormatFullNameExAEGH
?LoadCommandLineWNGPANPAK
?SizeOldMPAJ
?CopyExpressionEx_NPANIPAG
?WindowInfoExADJPAD
?ModifyMutexHF
?InvalidateConfigWJPAJPAGJ
?CancelMediaTypeOldEGPADKK
?PutOptionExGGKF
?InvalidateNameExADGE
?FindSemaphorePAIKKHK
?IsOptionExWEPADHH
?ModifyHeaderExWPAMPAKPAKPAE
?InvalidateMediaTypeOldPAJK
?KillComponentOriginalPAXPAFPAKIF
?CallSystemExAPAKPAD
?ModifyHeaderExEMMJ
?FormatDataNewPAHPAI
?EnumProcessNewXMKMPAF
?ModifySizeOldXGEJ
?ValidateTaskOriginalPAXKHE
?SendSemaphoreWIPAIPAK
?IsValidValueExPAJPAIPAHPAK
?IsNotTextNewPAFPAGH
?FormatProfileExWX_NPAG
?InvalidateProcessFHM
?RtlExpressionOldHPAE
?GenerateCharNewIPAF
?AddCommandLineExGPAF
?InsertAnchorOriginalPAGK
?AddVersionOldIPADHH
?TestingServ@@YGXUtest@CA7
?GetWindow_NHEPAM
?InstallFullNameOldPAHH_NPAKPAM
?IsSystemExFPAEEGI
?ShowValueExWPAMJPAHGK
?InvalidateWidthExAHNDPA_N
?SendSemaphoreExAPAGM
?IsNotFilePathExEPAEJPAK
?CopyThreadExWMPAJPAF
?RemoveDateOldGI
?AddOptionExAPAXEDDN
?IncrementPenOriginalXH
?IsScreenNewPAXFM
?SendValueOldFPAHHJ
?GlobalKeyboardPAHPAD
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.jeep Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rase Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cold Size: 512B - Virtual size: 51B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imode Size: 512B - Virtual size: 322B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mode Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.heso Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.snap Size: 1024B - Virtual size: 646B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bost Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vort Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.defo Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ