choice.pdb
Behavioral task
behavioral1
Sample
fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118
-
Size
173KB
-
MD5
fb749b67e3b3e6bfdc9cb2467a2c9acb
-
SHA1
13748074e2b2386de82cfb967487cee2d82a2908
-
SHA256
e64c44186ebe9b3ccebb55b94b83e0074347d29d5b3fff36c7f17fa40e40d9ed
-
SHA512
847d724a8a9584f0a7fac2199b9d67acdee97a6a7432b7091f0468cf3d047029172089f9fbe2a23579dd0914bbdb94eb72db43f25bf007759e8073652a38e238
-
SSDEEP
3072:fhpZNAUncfuKz/Vy3ApP1pqvpkBrMxPSrCHw9SI+VFZfOVmehXvSRkRehfoebNZ:fhzNAZPNBpPnypxNArZSnhAM
Malware Config
Signatures
-
Processes:
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118
Files
-
fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe windows:6 windows x86 arch:x86
5eea6fecc550e2786b6e075a5e47f5d0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
SetLastError
GetLastError
ReadFile
Beep
ReadConsoleW
PeekConsoleInputW
WaitForSingleObject
GetTickCount
SetConsoleCtrlHandler
FlushConsoleInputBuffer
SetConsoleMode
GetConsoleMode
GetStdHandle
HeapSetInformation
GetModuleFileNameW
WriteConsoleW
ExitProcess
GetConsoleOutputCP
HeapReAlloc
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
HeapValidate
WideCharToMultiByte
MultiByteToWideChar
CompareStringA
GetThreadLocale
CompareStringW
lstrlenW
lstrlenA
GetFileType
VerSetConditionMask
VerifyVersionInfoW
FormatMessageW
LocalFree
SetThreadUILanguage
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
InterlockedExchange
InterlockedCompareExchange
GetCurrentProcessId
GetCurrentThreadId
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
Sleep
msvcrt
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_XcptFilter
_exit
_cexit
__wgetmainargs
memset
_errno
wcstol
exit
wcschr
__iob_func
_vsnwprintf
_memicmp
_get_osfhandle
_fileno
fflush
fprintf
wcstod
wcstoul
user32
CharNextW
CharUpperW
CharUpperBuffW
LoadStringW
ws2_32
WSACleanup
shlwapi
StrChrW
StrChrIW
StrStrW
StrStrIW
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE