_MainWndProc@16
_StubFileWrite@12
Behavioral task
behavioral1
Sample
acdsee31.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
acdsee31.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
z-acdsee31.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
z-acdsee31.exe
Resource
win10v2004-20240226-en
Target
e9858a0540c2dd8538003fc1d56c5021_JaffaCakes118
Size
7.3MB
MD5
e9858a0540c2dd8538003fc1d56c5021
SHA1
ffb8207fedcec618d455629a99a7e70850ec7365
SHA256
99b0f1cf5253bb77fcac333993c4722d0f1517305ca26de972685a29964d28d4
SHA512
7f17e8466a9967f9c0e40cb9785b20587c054e51ddc14e439b389e7fb6cbc3813f295a51f47b25df5b135ddf025c920e36d04025bc839ead221f5a3ff74f327d
SSDEEP
98304:jRyD138EmMYErvIaxQIkq3BDdHC7aXtqk2iR2BYqKOuzhXumQGjNU0dFYYsVzl84:j6RvISkcDVCAEB8Feyj2uYFll8din
resource | yara_rule |
---|---|
static1/unpack001/z-acdsee31.exe | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack001/acdsee31.exe |
unpack001/z-acdsee31.exe |
unpack002/out.upx |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
GetCommandLineA
SetErrorMode
GetModuleHandleA
MulDiv
GetTempFileNameA
GetModuleFileNameA
lstrlenA
_lclose
lstrcpyA
FormatMessageA
lstrcatA
GetLastError
_lwrite
_llseek
GlobalUnlock
GlobalFree
GlobalAlloc
_lopen
GetProcAddress
_lcreat
LoadLibraryA
GetVersionExA
FreeLibrary
OpenFile
ExitProcess
GetCurrentProcess
WinExec
GetTempPathA
_lread
LocalFree
GetWindowsDirectoryA
GlobalLock
GetDC
DrawTextA
EndPaint
InvalidateRect
PostQuitMessage
SendMessageA
DefWindowProcA
GetClientRect
CreateWindowExA
BeginPaint
ReleaseDC
SetWindowPos
ShowWindow
UpdateWindow
SetTimer
LoadIconA
RegisterClassA
MessageBoxA
ExitWindowsEx
LoadCursorA
DeleteObject
PatBlt
CreateSolidBrush
GetDeviceCaps
SetTextColor
SetBkMode
TextOutA
StretchDIBits
CreateFontA
SelectObject
SelectPalette
CreatePalette
RealizePalette
GetStockObject
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
_MainWndProc@16
_StubFileWrite@12
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ