o:\Programmieren\Codesoft Releases\_NEW BETATEST\Codesoft PW Stealer\v0.35_older\abcdef Version\release\Codesoft-PW_Stealer_Server.pdb
Static task
static1
Behavioral task
behavioral1
Sample
edd25f1d35bfc7bb64e97afe43dd1aba_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
edd25f1d35bfc7bb64e97afe43dd1aba_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
edd25f1d35bfc7bb64e97afe43dd1aba_JaffaCakes118
-
Size
728KB
-
MD5
edd25f1d35bfc7bb64e97afe43dd1aba
-
SHA1
e7d4535e3a397b2f385419a7fd05122ba9a20c8c
-
SHA256
12bef50f0c62ad7a9cce0b8bb8c7cedb56ad21c74e2036bc36f879766cb55601
-
SHA512
6645be8fad31651facc7e495cafcd3e32b39001fae9df10bc89ee21f74faf571c7174f123f3228fa295b55a716cb8f8c2a1bfbd4b0b3daaf5d1fcc3900b3533d
-
SSDEEP
12288:+z9/32XvY6CD6zzXGytE0/OJKG+UlIKfJuUKo1nWjhStiSbUccDJIwsromZ:u9vesuzzXGyO0/OJKiICuUKtYcwUccHy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource edd25f1d35bfc7bb64e97afe43dd1aba_JaffaCakes118
Files
-
edd25f1d35bfc7bb64e97afe43dd1aba_JaffaCakes118.exe windows:4 windows x86 arch:x86
08d37522003b190ae5cf61dff1e0ee1a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FindFirstFileA
FindNextFileA
CreateFileA
CloseHandle
WriteFile
GetCurrentProcess
LoadLibraryA
FreeLibrary
GetProcAddress
GetSystemTime
lstrcpyA
GetEnvironmentVariableA
lstrlenA
GetShortPathNameA
lstrcatA
HeapFree
VirtualFree
GetProcessHeap
IsBadReadPtr
VirtualAlloc
VirtualProtect
ExitProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
Module32Next
Module32First
lstrcmpA
GetModuleHandleA
GetModuleFileNameA
GetComputerNameA
GetLastError
Sleep
CreateMutexA
CopyFileA
HeapAlloc
GetTempPathA
SetEndOfFile
GetLocaleInfoW
CreateFileW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
HeapValidate
DeleteFileA
GetCommandLineA
GetVersionExA
GetStartupInfoA
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
FlushFileBuffers
GetConsoleCP
GetConsoleMode
DebugBreak
GetStdHandle
OutputDebugStringA
WriteConsoleW
GetFileType
OutputDebugStringW
LoadLibraryW
SetHandleCount
HeapReAlloc
HeapDestroy
HeapCreate
GetACP
GetOEMCP
IsValidCodePage
SetFilePointer
ReadFile
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
IsValidLocale
advapi32
RegQueryValueA
OpenProcessToken
RegQueryValueExA
RegOpenKeyA
RegOpenKeyExA
RegCloseKey
GetUserNameA
shell32
ShellExecuteA
SHGetFolderPathA
shlwapi
PathRemoveArgsA
PathUnquoteSpacesA
wininet
InternetOpenA
FtpPutFileA
InternetCloseHandle
FtpSetCurrentDirectoryA
InternetConnectA
Sections
.text Size: 284KB - Virtual size: 283KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 104KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 316KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ