General

Malware Config

Signatures

Files

• f6f7c5035c194b349fc4ce2c4f04411f_JaffaCakes118

  .rar
• ORDER#710665_PDF.exe

  .exe windows:6 windows x86 arch:x86

  ca24a8fe7300d3915643d0e4fbc5d1cd

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\xampp\htdocs\Loct\6aab0bfc848e4d6b95ad98f5469ae1ad\Loader\Project1\Release\Project1.pdb

  Imports

  cabinet

  ord22

  ord23

  ord20

  shlwapi

  PathRemoveFileSpecW

  kernel32

  GetConsoleWindow

  GetCommandLineW

  CreateDirectoryW

  CreateFileA

  CreateFileW

  FindClose

  FindFirstFileW

  FindNextFileW

  GetFileAttributesW

  GetTempFileNameW

  ReadFile

  SetFilePointer

  WriteFile

  GetTempPathW

  CloseHandle

  GetLastError

  HeapAlloc

  HeapFree

  GetProcessHeap

  WaitForSingleObject

  GetCurrentProcess

  ExitProcess

  GetExitCodeProcess

  CreateProcessW

  VirtualProtect

  Wow64DisableWow64FsRedirection

  Wow64RevertWow64FsRedirection

  IsWow64Process

  GetModuleFileNameW

  lstrcpyW

  lstrcatW

  lstrlenW

  MultiByteToWideChar

  WideCharToMultiByte

  user32

  GetDC

  GrayStringW

  ShowWindow

  ole32

  CoInitialize

  msvcrt

  __wgetmainargs

  _controlfp

  _except_handler3

  __set_app_type

  __p__fmode

  memset

  _exit

  _XcptFilter

  exit

  __p___winitenv

  _wcsicmp

  _initterm

  __setusermatherr

  _adjust_fdiv

  __p__commode

  Sections

  .text

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ