C:\Users\Илья\Desktop\copy\Release\Glow Esp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0ec775234ee3f933aed34fec9f83437c_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0ec775234ee3f933aed34fec9f83437c_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
0ec775234ee3f933aed34fec9f83437c_JaffaCakes118
-
Size
25KB
-
MD5
0ec775234ee3f933aed34fec9f83437c
-
SHA1
7519e15e6b83d004048ad72d653e375709078867
-
SHA256
85043b4baf3d4e684f5db6e3092a5d03636b5c2140227ed933fcb548b9ef0e9a
-
SHA512
757a9de11f33f558b720d6217b4aad226ed52bcabdc84517006fd4c0361fdf1acbf1b5383c6a6beafda90baa27cdacc1a0f6d38d94955679b4df86f6bc3300e7
-
SSDEEP
384:18zGYUPfhQt6gmQkyGi+FYdJL0nR5VX47vVn5xUICdiEwrEiJ8nj63X+Ui5N3Q7t:7Lf59MuICd4rEiaCXPi59Q7GO/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ec775234ee3f933aed34fec9f83437c_JaffaCakes118
Files
-
0ec775234ee3f933aed34fec9f83437c_JaffaCakes118.exe windows:6 windows x86 arch:x86
340721cfe830862484f3aef0e3721cf3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
RaiseException
Sleep
CreateThread
TerminateThread
OpenProcess
ReadProcessMemory
WriteProcessMemory
SetConsoleTitleA
CreateToolhelp32Snapshot
Process32Next
Module32Next
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
user32
GetAsyncKeyState
msvcp140
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Xlength_error@std@@YAXPBD@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
vcruntime140
memcpy
memset
_CxxThrowException
__std_exception_destroy
_except_handler4_common
__CxxFrameHandler3
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_exit
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
__p___argc
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0
strcmp
strlen
wcslen
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func
__p__commode
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
free
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ