I:\Master\Slack\reffer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7b071cf28faacab21e05280109804c9e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7b071cf28faacab21e05280109804c9e.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_7b071cf28faacab21e05280109804c9e
-
Size
96KB
-
MD5
7b071cf28faacab21e05280109804c9e
-
SHA1
bd463a51b773125827df0809f5451974e85f370e
-
SHA256
14447d7ef49386a528c1ea1acf0d3f0bdd551e3c46e1d2569e4208fe486cd7b9
-
SHA512
793e7793c198caa9319430cbfd07b0ff5a60bac3922ae4b959f83360987b8b9461518042b17a57468c359b204130cb2afca09b50a574938db875062ea8534952
-
SSDEEP
3072:8lSdTEqSxqwuWNS9+m69MFtJo8egbxkK:8l4TDkN4tJB3dkK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_7b071cf28faacab21e05280109804c9e
Files
-
JaffaCakes118_7b071cf28faacab21e05280109804c9e.exe windows:11 windows x86 arch:x86
29a44843ee0beb8837ecd5b5f0799036
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
DestroyAcceleratorTable
MapDialogRect
shlwapi
StrCatChainW
StrCmpLogicalW
ChrCmpIW
ord29
UrlIsOpaqueW
UrlGetPartA
kernel32
lstrcpyA
GetProfileSectionW
Exports
Exports
?ModifyKeyNameExWPAEPAJPAIPAK
?RtlMessageOldPAE_NDMK
?GenerateWidthWPADIHEH
?ValidateClassPAFKPADNPAI
?RemoveProfileOriginalXPAMPAI
?InvalidateListItemW_ND
?RemoveProfilePAJIKPADM
?CrtFolderPathNewFE
?CrtStateW_NJJ
?DecrementMemoryOldPAFFPAIPADPAF
?InsertVersionNewXIH
?RemoveTimerFDPAK
?InsertThreadAJK
?FormatWindowExAPAKDH
?RemoveKeyboardExAFHPAFNPAK
?FindObjectOldPADDPAD
?SendDialogExAPAXD
?ShowFunctionOldEPAHPAK
?RemoveTaskExWPAFPAJPAJGK
?FindAppNameExAF_NPAIGPAE
?FreeTextExWPAGDEF
?InvalidateStringExAXPAHHPAG
?HideEventExWHKPAI
?RtlFolderPathExAJPAD
?OnTextKGPAH
?DeleteCommandLinePAHPAJ
?RtlFolderWPADGFPAJE
?IsNotMemoryExAKHFEPA_N
?CopyValueAKK
?IsNotHeaderExAXN
?InvalidateKeyNameExWEI
?CloseEventExJJHJPAG
?EnumCommandLineAXE
?ModifyValueOriginalXJDPAN
?IsSizeExPAJ_N
?DecrementSizeExAPAKPAHPADI
?FreeNameNewPAJPAD
?InsertMessageExWXPAG
?ValidateProjectExAFIJPAKG
?FreeListExAGPAHPAGI
?InsertTaskAPA_NFPAFG
?InstallNameAEINE
?IsObjectOldPAEPAHIPAHI
?ValidateMonitorOldDMDM
?FreeProfileOldFHM
?FreeStateWI_NFPAKM
?CloseProjectWXPAM_NPADI
?FindSystemExWPANE
?GetSectionNewGPAFEHPAE
?AddWindowExKPAEPAJME
?CrtPathWKE
?InstallAppNameNewI_NM
?EnumWindowExPAKPAGHPA_NPAJ
?GetListItemDPADPA_NGF
?FreeProfileNewPAJPAHG
?IncrementEventOldPAEEI
?SetSystemExADHFME
?HideNameAPAXIPAMG
?EnumKeyboardWPAIDD
?FreeSizeExWXEPADM
?RemoveTextW_NGPAHJM
?PutTaskOldXD
?IsValidNameOriginalHDPAE
?FormatRectAPADMPAEJE
?CrtDeviceOldPAFG
?ShowSizeExWPAFEMNK
?GenerateWidthAFPAEPAM
?IsExpressionExWPAMPAIPAE
?HideComponentExEPAJPAD
?DeleteNameExPAFPAE
?FormatDateExAMFGED
?DeleteStringOriginalMNPAIPAM
?CallKeyNameEKPAEH_N
?GlobalListOldXI
?IsValidVersionOriginalPADPAJ
?KillHeightAPAIJ
?CloseStateExGPAJ
?CloseRectOldFF
?ShowFolderPathExPAGEPAD
?GenerateAppNameExAPAKPAKIFPAH
?IsValidStringExX_NPAEH
?IncrementTimerNewXDK
?CancelSemaphoreOldPANMMPA_NK
?FormatCommandLineOldXPAMNMPAG
?IsPathWJJPAEGPA_N
?FreeDirectoryPAHPAFPAM
?IsValidValueExAIPAFE
?KillThreadAJK
?IncrementStateOriginalPAFKM
?GlobalHeightExAXNGPAIG
?CopyKeyboardXPAFPAHFPAM
?GlobalDateAKJPADPAJ
?CallComponentExWMHPAJPAFN
?ValidateAppNameExIH
?InsertSystemOldPAJK
?FreeWindowInfoNewE_NIE
?CrtFullNameADPAEMPAMM
?InsertSystemNewMHJ
?CrtMessageAPAJPADFN
?GlobalProjectNewKPAEHK
?InvalidateFunctionOldH_NNPAHPAJ
?OnMutexAJPAJD
?PutSemaphoreOldDGHPAE
?ShowAnchorOldPAXPAF
?CrtKeyNameOriginalPAFPAFGDD
?FormatFullNameExAEGH
?LoadCommandLineWNGPANPAK
?SizeOldMPAJ
?CopyExpressionEx_NPANIPAG
?WindowInfoExADJPAD
?ModifyMutexHF
?InvalidateConfigWJPAJPAGJ
?CancelMediaTypeOldEGPADKK
?PutOptionExGGKF
?InvalidateNameExADGE
?FindSemaphorePAIKKHK
?IsOptionExWEPADHH
?ModifyHeaderExWPAMPAKPAKPAE
?InvalidateMediaTypeOldPAJK
?KillComponentOriginalPAXPAFPAKIF
?CallSystemExAPAKPAD
?ModifyHeaderExEMMJ
?FormatDataNewPAHPAI
?EnumProcessNewXMKMPAF
?ModifySizeOldXGEJ
?ValidateTaskOriginalPAXKHE
?SendSemaphoreWIPAIPAK
?IsValidValueExPAJPAIPAHPAK
?IsNotTextNewPAFPAGH
?FormatProfileExWX_NPAG
?InvalidateProcessFHM
?RtlExpressionOldHPAE
?GenerateCharNewIPAF
?AddCommandLineExGPAF
?InsertAnchorOriginalPAGK
?AddVersionOldIPADHH
?TestingServ@@YGXUtest@CA7
?GetWindow_NHEPAM
?InstallFullNameOldPAHH_NPAKPAM
?IsSystemExFPAEEGI
?ShowValueExWPAMJPAHGK
?InvalidateWidthExAHNDPA_N
?SendSemaphoreExAPAGM
?IsNotFilePathExEPAEJPAK
?CopyThreadExWMPAJPAF
?RemoveDateOldGI
?AddOptionExAPAXEDDN
?IncrementPenOriginalXH
?IsScreenNewPAXFM
?SendValueOldFPAHHJ
?GlobalKeyboardPAHPAD
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.jeep Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rase Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cold Size: 512B - Virtual size: 51B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imode Size: 512B - Virtual size: 322B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mode Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.heso Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.snap Size: 1024B - Virtual size: 646B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bost Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vort Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.defo Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ