C:\Users\vanya\source\repos\Client SQL\Release\Client SQL.pdb
Behavioral task
behavioral1
Sample
2db0d170909635fe7ad3cbc11e676b5f_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2db0d170909635fe7ad3cbc11e676b5f_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
2db0d170909635fe7ad3cbc11e676b5f_JaffaCakes118
-
Size
837KB
-
MD5
2db0d170909635fe7ad3cbc11e676b5f
-
SHA1
ba1829373d9ac3dd06da37b5b79075dc2d31081e
-
SHA256
6f0e5b240c8bf6993cbe37aeb2a89b70346bb7500d863ce0e4805b1f8452b7fe
-
SHA512
c4a0a064ed344a954a67d84646c146b2f24a5c1e9fd61b12eb8d7478a4c681ae2ce888016099a85336896130f479662c11c3ce806e6a91fadb989495bfd25e5a
-
SSDEEP
12288:fPnwDVqd1HpG1X2dByV0wIIut7lxQgvK9P414cAHDxYSM83/EWarw0IwgpLeONfv:fPwCG1GG01t7sCK+1kFFM8Pgrwc5Wf
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2db0d170909635fe7ad3cbc11e676b5f_JaffaCakes118
Files
-
2db0d170909635fe7ad3cbc11e676b5f_JaffaCakes118.exe windows:6 windows x86 arch:x86
cbc7d3c11952529b2db893d8e27757d6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
SetStdHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
msvcp140
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
vcruntime140
memset
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fgetpos
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
�Y( �a4�'O^�>v2�^M^ˣ�>6(�r6�\)�<�b���~Z��Zmh8�g]�GDJ咴ݵ����p��d�B�� $���pP4��J�Fo,�7���&���F�lM�Z=���~����E�2q�X��>��*��%�����Z���]��!�`{)Y��߬%x2#�J����b�^� N@v�����WY�{1���Ԏ?�={��o�cӦRmx�o�~�`�m��-�k*�/Q�Lau��i>�F���#s������U�).h�BQ�;����&��9+uVi�X ]>!�C�إ�V�8���&��[�� 5�v����J(�!�;F�7�R[M""?�n�vO���Q��{�۬��~�j@�|��B4��F�4�S9��2(:x/z��L�)������'Ys����I�pZP�u��?��JQ8�(6��� ���}&]t� � ��5����R�K���l�����5"OWK��>�wG�/Ғ�q��Ry� �z�r!�?�?������jh y��OnS�㺒�h��]��:y�g��t&B ����'=��'_gz�$���hd<���SYm�mJ����8v�1�=9+/~YG������5V*��fe ������b���� l3��H��Ʒ֨2V$�6�ҌdZ��ި({�g��K���a�UM������Εe��I�(D4����Ŧ�.��4��O�5����c�A0gȚ�Ο�|�� ��j�=8&柗���gJl���m�Φ_��[�c�3�]J(ZLz�nK�"6F���Ae�~�_�K`�_�)��U�Ij����Pԅ�ձ�'x���|����m�ݰLݹi�Y�"��YZ�G�Y�*����N��G�j���cXt��9�}A����8��~X�hx��q����Y��9-e�a�� ��}�g�g�A?���[n����=W(G�'��&=;�L�O/����>�q���L������rh�|hzٸ�i�|�֎ � ���`O-H˟@A�R�mh�B�����D�4�/~���o;���?=����6�s*1u!?ۄ��<A�xn58F�D�n��OIu_t��y�K��*��� �M[eE��[L�ʤ���T�'=].Ң��o�1��hl '�-m ��ҹ�H��D�4�ɨ�+3;1H� �!"�� x��_;&�d����&��m$��^ ���4�ad�yu�F�~�L�4'-PI闦6^��*��դ�J:��0����t��t3���㵮kv�i�iS5���m$ �:���P�O>Ĭ�����r��/{�RN]g�*���L�N^��qRY�@O�ۺ;al��\m���ʓ��'7P6�6��k���4&�n���,�G� �T��èPfG3@�4�V�`e" .��o �����+�4߷���&k�Y�9ɱC��^�2�:�K@���m��#�,|F���ڝ�?6�W7LBYJ�F"���h+�� �;G�i��*���]Os�\��ћ�6t���������Et��ͱ�����iy��3�c�7��Y?�V�`��c=5���hd�[8;�w��������ԛ�B���z�Q�`� '�RB ��=-��߷�K*�,��Ƹ_m�5��_\w����Uz496��'CK�^��7W�8 <��e��7f��a�����*�ө�wR~��Mt�T�F �A����s�����v*e�,5&g�%��c�v�k��L�� r$�ex��C�xv3���-���>su�7�ypM*ng����אѩ8|�>� e�����ӛD�������4��H�V��>�6�v�!O�)��p���<�� �@��NGF����I6吡4�d�,��UA������x��@oI�R���1�+(��U���h�u���,���8����*v����?^��j+��A��v~ƙ���o0}�!u�����^��P�bl��&��k�H�8FDQ�����M��)�G�)V�k r�0:��[i�<�t�4� 2��IK���ɗ�6=8�̐�!�l���^h��7�҂[{N��[Ywr��32�����DžK�G����Q��^zayp����-)�\�0�;�D�#iA����<�Q,����ϰ��?U+k�~PF,�]'Q���Zb<_Y����Q ��Ԣ�DH��S��+`W=i��0]��'=�6R��k�@;g��C�4i\|$xa6�8Zi��&��M?_�מ�����Ls���2�])#�6 d���ohT�nju��̝@�U�i���z.�Og�J��ϚzZ�U���I���&4#6�W �H���:��Z���|R��.\Lf��<[?ir*N�R0��1`L�xGlK���A+333LV�n�Yl� �_����ZAG=]��)��nQ�P��L}S��WƉܵ!s�A�dSp�@&���75�r`Hz���?�8�Z�P_��^���J�M���YMۀ���eC(��~�F����(&g�E�n�Z��+�?Т�����6�Y���NK¿4jB��z�ۯt���,`�-���u���+lD��U@֠;lG��:t���n@P���r+6�(S������o��i�8����/9���9s�x��� �ma��ӱ\����~J�������8�ݍd<�h�&G��1J��S����䛳0 C�ʈ_�����y��k���� )<�ʇ���)!�?�_0�4vގ6�a�P�%��G�1H9Զ�tsB���QN0�7i�|���6�d[z�^o����\��_�;/��(��3���2���v����[b�������U92&motK�e�d��b֙�QR��V]��d�5��ӴK�դ��qm���4���hv�lj{���r�Iŕ���`���Z�q$R������bn�GC#�ţ�|:Ʃ�R"��l7�J�*E:踜�w e����h;�𗺖�"��[�)��O !>������*�`��Ls�-#ʍ�9�{�T�EV��|]�����s)6�Q��|�<f���TW��)�桒���� =O�=�O�Ԉ�8 �ӨM���Nm�МĔ�#x��@����J݉��I���5 ȱ��[��4��*�z���i���
Sections
.text Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 711KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 830KB - Virtual size: 829KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ