C:\nazepomo.pdb
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_cdb4cf1445c3d7c32de55258685d9565ea268d7ddca0d64cf4c8c7600fa039b6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_cdb4cf1445c3d7c32de55258685d9565ea268d7ddca0d64cf4c8c7600fa039b6.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_cdb4cf1445c3d7c32de55258685d9565ea268d7ddca0d64cf4c8c7600fa039b6
-
Size
316KB
-
MD5
43d834f11fd8031dbcbba48f168447fe
-
SHA1
a66fa5a150db13a503f7bbe61349e230b70200ad
-
SHA256
cdb4cf1445c3d7c32de55258685d9565ea268d7ddca0d64cf4c8c7600fa039b6
-
SHA512
6aefca2f0b7bb4c41f986a730c1e13ef8cd71f9cd0883ae29fe1330bdc3972e5a0fcc1f7782f2a69ad4fcd77f653551e4aa5f397b2fccb00447f03d70252fbea
-
SSDEEP
6144:p5NbF5iFmK7Tm8krgjIENQgLFDJHjYWwftZ2mi3tj:8FN7Tm8krgjIENQgLFDJDwfk39
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_cdb4cf1445c3d7c32de55258685d9565ea268d7ddca0d64cf4c8c7600fa039b6
Files
-
JaffaCakes118_cdb4cf1445c3d7c32de55258685d9565ea268d7ddca0d64cf4c8c7600fa039b6.exe windows:5 windows x86 arch:x86
2aa979ef3cea65356d0640f20de6e03d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
InterlockedIncrement
_lwrite
GetSystemWindowsDirectoryW
GetNamedPipeHandleStateA
GetComputerNameW
FreeEnvironmentStringsA
GetTickCount
CreateNamedPipeW
GetProcessHeap
ConvertFiberToThread
GetSystemTimeAsFileTime
GetPrivateProfileStringW
GetWindowsDirectoryA
GetSystemWow64DirectoryA
QueryActCtxW
CreateActCtxW
GetSystemTimes
GetDriveTypeA
TlsSetValue
GetConsoleMode
GetVersionExW
HeapCreate
HeapValidate
GetVolumePathNamesForVolumeNameW
IsDBCSLeadByte
GetModuleFileNameW
CompareStringW
GetStartupInfoW
VerifyVersionInfoW
FindFirstFileExA
GetHandleInformation
GetLastError
SetDllDirectoryW
GetProcAddress
GetLongPathNameA
SetFirmwareEnvironmentVariableW
CopyFileA
GetConsoleDisplayMode
FindClose
LoadLibraryA
LocalAlloc
IsWow64Process
WritePrivateProfileStringA
IsSystemResumeAutomatic
SetCurrentDirectoryW
SetFileApisToANSI
QueryDosDeviceW
GetModuleFileNameA
GetOEMCP
GetModuleHandleA
GetProcessShutdownParameters
CreateWaitableTimerW
FreeEnvironmentStringsW
WriteProfileStringW
RequestWakeupLatency
BuildCommDCBA
GetConsoleCursorInfo
ReadConsoleInputW
TlsAlloc
FileTimeToLocalFileTime
CloseHandle
CreateFileW
FlushFileBuffers
CommConfigDialogA
SetWaitableTimer
GetConsoleAliasesLengthW
SetLastError
lstrlenA
DeleteFileA
GetCommandLineA
HeapSetInformation
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
InterlockedDecrement
DecodePointer
GetModuleHandleW
ExitProcess
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
IsBadReadPtr
EncodePointer
TlsGetValue
TlsFree
WriteFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetCPInfo
IsValidCodePage
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
RtlUnwind
RaiseException
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LCMapStringW
MultiByteToWideChar
GetStringTypeW
IsProcessorFeaturePresent
SetFilePointer
GetConsoleCP
SetStdHandle
user32
GetCaretBlinkTime
GetComboBoxInfo
gdi32
GetBitmapBits
advapi32
SetKernelObjectSecurity
AbortSystemShutdownW
Sections
.text Size: 215KB - Virtual size: 214KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 35.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ