C:\popajar3\SDKObfuscation\Obfuscator\WrapperXtraLITE\WrapperXtraLITE.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e9526922fefea88d1cbf6481560132cf_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e9526922fefea88d1cbf6481560132cf_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e9526922fefea88d1cbf6481560132cf_JaffaCakes118
-
Size
277KB
-
MD5
e9526922fefea88d1cbf6481560132cf
-
SHA1
d65134a885cb9760b6e49363b7759f0292f268de
-
SHA256
23010c378abd9a034521a9e97ea58e7b41d4c56ddafd92e016709b44bad50848
-
SHA512
9fc50a2c00f0c4afe6c37bf4943a24383c872006e8404e1400d4a1ee05cb9a7993c4a41c60d95757bf4b9348699fe268b273447e76019321f196d7aac21d2a0c
-
SSDEEP
3072:nraCibNeLSAHdAL4neDhqSq1Pl9qRu+0ME4Ag0Fu0Ag0FuZi/37TO8Ix:rfiJ+nhnmMD1P/qRu4AO0AOyr/C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e9526922fefea88d1cbf6481560132cf_JaffaCakes118
Files
-
e9526922fefea88d1cbf6481560132cf_JaffaCakes118.exe windows:6 windows x86 arch:x86
ac32bf2389f5692bca840cd41cadcdfb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetOEMCP
lstrlenW
GetACP
LoadLibraryA
GetProcAddress
GetLastError
Sleep
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
GetExitCodeThread
CloseHandle
SetEndOfFile
CreateFileW
WriteConsoleW
SetStdHandle
LoadLibraryW
OutputDebugStringW
LoadLibraryExW
ReadConsoleW
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetLocaleInfoEx
GetStringTypeW
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineW
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
GetStdHandle
GetFileType
InitOnceExecuteOnce
GetStartupInfoW
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
GetProcessHeap
WriteFile
GetModuleFileNameW
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
FlushFileBuffers
IsValidCodePage
SetLastError
GetCurrentThreadId
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
GetModuleHandleW
GetUserDefaultLocaleName
LCMapStringEx
IsValidLocaleName
EnumSystemLocalesEx
SetFilePointer
user32
IsCharLowerA
IsCharAlphaNumericW
IsCharAlphaNumericA
IsCharLowerW
IsCharUpperW
IsCharUpperA
IsCharAlphaA
Sections
.text Size: 161KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ