c:\low\Control\Force-Miss\Size_Fruit\fell\Test.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ed60097b0bca7f9c4649ba5d5a088fc9_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ed60097b0bca7f9c4649ba5d5a088fc9_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
ed60097b0bca7f9c4649ba5d5a088fc9_JaffaCakes118
-
Size
544KB
-
MD5
ed60097b0bca7f9c4649ba5d5a088fc9
-
SHA1
19b5c95728b212a75adf3e4d2932f411f6c68f9d
-
SHA256
a5540f6dd0f7761dd3f7e52f5e1d25332b99d95cccf63401d202406160948750
-
SHA512
0b505fd6aeea6d2ccab97a5989357985b8bc5081dd2fd7801fb8b7cfd201d4479ad256bf35acf04ad41e9b972a7a6ebd41ba593b083cfdae29f78ebd29d19340
-
SSDEEP
12288:rqru80paIRPWxvFzhzFIkofIcYrIAfDE0cb1Yklllll/lllll7K10QUNI0H:rs0IIFWx9zlFIkofDY8kcbHlllll/llH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ed60097b0bca7f9c4649ba5d5a088fc9_JaffaCakes118
Files
-
ed60097b0bca7f9c4649ba5d5a088fc9_JaffaCakes118.dll windows:4 windows x86 arch:x86
12994b2554048ef1e6f7b4dd1e874109
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FlushFileBuffers
CreateEventW
LocalFree
LocalAlloc
Sleep
FreeLibrary
GetTickCount
GetProcAddress
LoadLibraryW
VirtualProtect
GetTempPathW
GetCurrentDirectoryW
GetConsoleOutputCP
WriteConsoleA
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
LoadLibraryA
GetConsoleMode
GetConsoleCP
SetStdHandle
DeleteCriticalSection
HeapValidate
IsBadReadPtr
RaiseException
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FatalAppExitA
GetLastError
SetFilePointer
CloseHandle
RtlUnwind
GetModuleFileNameA
HeapReAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
InterlockedIncrement
InterlockedDecrement
GetModuleHandleA
ExitProcess
GetACP
GetOEMCP
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
DebugBreak
WriteFile
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
MultiByteToWideChar
ReadFile
InitializeCriticalSection
CreateFileA
user32
GetWindowRect
CreatePopupMenu
GetSysColorBrush
DefWindowProcA
GetForegroundWindow
CreateDialogIndirectParamW
GetDesktopWindow
GetClientRect
IntersectRect
ExitWindowsEx
EndDeferWindowPos
InflateRect
DialogBoxIndirectParamW
msacm32
acmDriverDetailsW
acmDriverEnum
acmDriverID
acmDriverMessage
acmDriverOpen
acmDriverPriority
acmDriverRemove
acmStreamOpen
acmStreamPrepareHeader
acmStreamReset
Exports
Exports
Bird
Bluemean
Sections
.text Size: 372KB - Virtual size: 368KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 136KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 630KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ