x:\Dev_CPP\Work\VS_KnzStr_Adware\Release\VS_Work2.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f3517cd18093ec79f89422a79e2ed000_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3517cd18093ec79f89422a79e2ed000_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f3517cd18093ec79f89422a79e2ed000_JaffaCakes118
-
Size
77KB
-
MD5
f3517cd18093ec79f89422a79e2ed000
-
SHA1
ebb43472c80b56793e4b41f48a362337ef149fed
-
SHA256
82b16c3d9c2992df9f86765bedecaa31a8bd378c982ebd6aa9ebc02c6e8d1025
-
SHA512
db80bef7226421f387e2262d0734e9307c409e6bfa97c7033ee6d38b8a8dfb1e7e5379c5e97692f1e3725b80ceb324833ba413e18c24018a6ec1e34a61768098
-
SSDEEP
1536:tNEQGBSGDByNNPbQyOG9eE2weZ72caQc5om:tN4FKFrsLwkaQc5om
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f3517cd18093ec79f89422a79e2ed000_JaffaCakes118
Files
-
f3517cd18093ec79f89422a79e2ed000_JaffaCakes118.exe windows:5 windows x86 arch:x86
b9a0802fb9acc7907798e9f0287cab18
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
TerminateProcess
WaitForSingleObject
Sleep
CreateMutexA
CreateThread
TerminateThread
CreateProcessA
GetFileAttributesA
GetModuleFileNameA
WinExec
OpenProcess
GetConsoleOutputCP
WriteConsoleA
SetEndOfFile
SetFilePointer
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
ExpandEnvironmentStringsA
HeapFree
GlobalFree
WriteFile
CreateFileA
GlobalAlloc
GetProcessHeap
HeapAlloc
GetTickCount
Process32Next
Process32First
GetLastError
CloseHandle
CreateToolhelp32Snapshot
lstrcmpA
lstrcatA
lstrcpyA
WriteConsoleW
lstrlenA
GetCommandLineA
GetStartupInfoA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
VirtualAlloc
HeapReAlloc
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
MultiByteToWideChar
ReadFile
LCMapStringA
LCMapStringW
GetStringTypeA
user32
CharLowerA
DispatchMessageA
TranslateMessage
GetMessageA
SetTimer
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
DefWindowProcA
PostQuitMessage
FindWindowA
SendMessageA
SystemParametersInfoA
DrawTextA
GetSystemMetrics
ReleaseDC
GetDC
CharUpperA
gdi32
TextOutA
Rectangle
SetTextColor
SetBkMode
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
SelectObject
CreateFontIndirectA
GetDIBits
GetObjectA
DeleteDC
advapi32
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
Sections
.text Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ