C:\qEjn\jutBwxdL\PDylgVge\lkiNg\sBtWi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
PLAY_M~1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PLAY_M~1.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
PLAY_M~2.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
PLAY_M~2.exe
Resource
win10v2004-20240412-en
General
-
Target
f9e938e4cef7df9c20c9f831eedd1726_JaffaCakes118
-
Size
233KB
-
MD5
f9e938e4cef7df9c20c9f831eedd1726
-
SHA1
2ebc6f4c252a643b2f96906d9388fc96ff596352
-
SHA256
eb190bd517c5cf3cc43a52bdcf2c747dba4d114f2c291bc76ccc77a786caa85b
-
SHA512
e4e27ca6366ab1028f43eb6da387842e40536a1ff38cf92e70979d2eae52368fe8f1736876d1fdf0e5ac332bac5e35a627c57876426af8033c402e8c8d4e001a
-
SSDEEP
6144:rmCd3OSjS+ajrF0pFoxQfuscLyQorlOu3uFJ:NROxjupvftcu7lzeFJ
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/PLAY_M~1.EXE unpack001/PLAY_M~2.EXE
Files
-
f9e938e4cef7df9c20c9f831eedd1726_JaffaCakes118.cab
-
PLAY_M~1.EXE.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 269B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 738B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
PLAY_M~2.EXE.exe windows:5 windows x86 arch:x86
6174b8e95c2d75962cb667091c0db5e3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
GetTickCount
GetStringTypeW
DeleteAtom
QueryPerformanceCounter
lstrcmpA
VirtualQueryEx
TransactNamedPipe
FileTimeToSystemTime
SetNamedPipeHandleState
FindResourceA
SearchPathW
user32
SetActiveWindow
GetMessageExtraInfo
CopyAcceleratorTableW
PtInRect
SendInput
ScrollWindow
CharPrevW
CopyRect
MessageBoxExW
GetDCEx
EndPaint
MapVirtualKeyW
shlwapi
StrSpnA
gdi32
CreateDIBSection
GetTextExtentPoint32A
GetCurrentObject
AddFontResourceW
GetROP2
CreateDiscardableBitmap
GetMapMode
comctl32
PropertySheetW
ImageList_GetIcon
PropertySheetA
Exports
Exports
?ArsJzLgv@@YGFPAI@Z
?gphZzplhQ@@YGXF@Z
?vdiPeblifraqajjllzusji@@YGXE@Z
?OHobdzbu@@YGXGPAE@Z
?mWxJnvkjhOawsUpomgu@@YGGD@Z
?ncCyeluKfRiFy@@YGDPA_N@Z
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ