C:\Users\vanya\source\repos\Phoenix Recoded\Release\Phoenix Recoded.pdb
Behavioral task
behavioral1
Sample
356242dda8ab7e25cada4061d46d4844_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
356242dda8ab7e25cada4061d46d4844_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
356242dda8ab7e25cada4061d46d4844_JaffaCakes118
-
Size
1001KB
-
MD5
356242dda8ab7e25cada4061d46d4844
-
SHA1
e04efcd7ceafc726b1b43ff84946381488938ad9
-
SHA256
bb1ab9525f08cdff0fde5c00a90c8ff2c31d7882e91550d7d359b709b2020d72
-
SHA512
a788a3630b7902bbe43a50d5650b66cc67a943fe4b0459eaa0e7b9c96643f0c9258cb3593583d6780d60796c2cb4b98d29599f9d6f968e01666dcd74257d0861
-
SSDEEP
24576:p5n+6YW0q1+PLBGZB9QgFOVhscwagGjkgcG1C2Kj:K6vZmBGf9lFOVhhwrHGoXj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 356242dda8ab7e25cada4061d46d4844_JaffaCakes118
Files
-
356242dda8ab7e25cada4061d46d4844_JaffaCakes118.exe windows:6 windows x86 arch:x86
2125312f1fc3537a81453038ca224718
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LoadLibraryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
advapi32
GetUserNameA
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
vcruntime140
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
Exports
Exports
`+3�'n9��Ê������n�d����bӧxf���ļ�����;}ƴ��u�nW�̒jO=́���W�`V��a 2u�Z���� ��H}#�O��P4�����Ue~��G�ƞ��19�6[�"��(���GZF8㍰�{��cW]��+ϥ �ȽU�����@$�G��j֍,E�G�����Ú�>��x��v�h��:��p�b�s��G������{"uԅ��]�0{4R07ԈG?9����z�ڈ�e���|�ɮ�8�� �-�ٌ���zj���x�3Bv �ԛy20�g��1��O̫�C�k8Ri�YyF5�ܠ ;�̀[���ل���1����t8V�j���s�e,!�Q��+j<;� �%�#������4�&��WEy���Yd2�~���אQ�D��+fR3�@J�̽�E�zF����)GCF�&M� 8ZX�+VN,W���(�|��PS�Y�^ua'D:S�-�1�1Š%Aj/��BO�U�!U�?�_��&8��t�s>&�w^�#���O��@��0q=��v�J���{怣�a��9����4%`}P�M��O�i�J�����W����dL���혇c��0�e*k��LyG�OQsLDpl�0� �g�Yj��`"��-hPM�K�B�A�?\;����v[�̾g_��>04Ҧ���������鎺�8,t��{JQs�6��Wؕ ��H����8���$P[��+l���*bd��.S$���J�,�[4������ OuJ ��!?�l�3Wx�^E" ��#ھ����n���A<\�RG�56��R;ܓ�� ��A�3��ό�*d�N:h�2�٭�=��F*ž7E�iL|B�m�H�2���"<.5�ք�q���~����tuoQ^�/�kOm5��^{�(l��Qa�����/�@3��,������� �$�O(]Æ �'��2M|Q�H�l��வZ�a�+�]�7��}���f��r��J��K���!��:}�B����<�վ'aw�� ���4����>�E���-$_w5]d��}2t�v�������_ ���(9>W/ L��eT���?��f�@�͐56��蕄�.+a���D|�D��T'd!p��Y�|<�G��h{�҅��sW��p&X�"��������\~_�O1�7�;�Z>8;5c�����!$��9��wͅ��$���n������ ��m$�fp�P����S0���}�"�!����\6�J2��?Mn��FK��VxY.[~E�����y��:�0�b�c�ۋ/a�vș21<K-N��3�y���� ���*Vte-�t1W(G�Tߊ}(zOE�}�c�P��ˋ�yz|��HY���%8i�gsvK�wQ4oa��)�����1���%Rl:�d�E��1�>�L�^������#]av �6�����inA0��!EV�Q��q�U����WX��n�Q����j(y�6ሾ�+<g��FS��}�4{��+�k���*ODKE���p�`TS�6�unӡB�����p�{�m�Տ�9���Bx�%Ǹ}��=���q�N�@Zd*���%�#\�q0���ta�r�p�C�A��r�۲P;�k]H��}p�`���TNM�J�ì�����?�Z,�f��Y:�X!G�E�:��60q�M�'�$wJkD�O� ���z����J�L)D���vJ�~,T�����u��A�}����s�Ʒ�����=;L� ��2y��B����+F�5�6-���D5���֔�Y��O�x�M�'0�>0�y��:vX���.����s�s�6�\%vr��������ϔ�F#�J�Ƶ��}u5��,�)b-ؔ�9�p��I=��)w��WD���zs�A���N�b�g]`�̇�m���p��2E^�}�}������P'���H����x�;�y�NG�98�S6�������P$6�;��i�dz���F�J7�U�2���*��T��f�R��F?Sq8��Mrtv�.?� ���NUv٘�����a���g������0���_��'+���3d$�4ù$�G��ޒ�K�����ٴ|%��m�!L=��{�>]�ʳ���囝f���f�2~�ќy��0a�l��F߹�Y{j�{gX��E���'�h�%_�<������W+;�'�m� ���,pR�����)+�O4�"�s*�(�D�ێ\J%���2���{����;H�IH����xu~�U1�'5EZ�I��kC�)��y��I%�X���>xo͢�� �aC7�} E�������<��Mx�ζc��o�pkg����F��'�uz�o> s��ysiI�W�Q�0[�;A�Q����b�p�h~�������7����tS�~��"����T�9B@#��pC�[J���u�m�<,�����D��k4�d>�''{�فхm�>+ ��T6w]��ˮb�Lz����W��@�ٙ� ������cs���hY[�9=�&����7v���XC8G� Z@k�ȾJ��t��M�A�|MZ����b�e���ͺ(c�Y>��Yc�N��OҚ�B-�.�Mh8R,>�q>�s���`'ݻ�-W�q�9�븏5��T�ٸ��A���4�V�>`����D�bo�8^c��|�0���#�m�|��B�<�)����&�}a�K~vw �m��կ-���*2�wW=�����>)���&19|���Xs<��Q�A\G���9C�3�c{���N1 ��Pwv� D xx ����; p��C�O�ԸQ�K�A���6����E ��3��"{���}�[i �(��`��A�K�XU|��8+d�����&��~�v�����Y+�����V`&��_�������|qW�!�}��Rg���.Y��4��ܹ�iW 5້�d+����q3)?E���`5uw��%�[�|��,����E���Z�����G��5*�ݘ'<�A/���5; ������|�r+� ą�@L�WW�jJb&��y�YzA*`��+Xc�ɏ��R[��CC�����K�/Q�C�55��� ^2GB�l�Ť�!�G��35�%اP���s�"k���
Sections
.text Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 786KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 968KB - Virtual size: 968KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ