d:\Documents\Visual Studio 2008\Projects\UnInstall\Release\卸载.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4f162fdcbc5fce4321c0380345a1986d_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4f162fdcbc5fce4321c0380345a1986d_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
4f162fdcbc5fce4321c0380345a1986d_JaffaCakes118
-
Size
54KB
-
MD5
4f162fdcbc5fce4321c0380345a1986d
-
SHA1
31366fcbfb4ce60283cc06023ef408c1c71adf23
-
SHA256
39813b167743d8df5317bcc65326fdc9f58a9132aac93d4a8c09da5697453b9c
-
SHA512
4fe8400dd2a3535637252f481bdeb339a77279073fc70f36e630aba4df6ed5b8a7cc93ea7bf663e845cda73d1b208680f4f57506aa9f755f8c4431a751a7fddd
-
SSDEEP
768:J+NH8HjcEvkCsEsGJBcIidNls8hZk/WPwFwadNls8hZk/WPwFwyVxP:J+NH8HgW9s9jdWdGX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4f162fdcbc5fce4321c0380345a1986d_JaffaCakes118
Files
-
4f162fdcbc5fce4321c0380345a1986d_JaffaCakes118.exe windows:5 windows x86 arch:x86
2c0d37a3b737080b1c9c5265afe86b42
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
QueryPerformanceCounter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateProcessA
CreateThread
DeleteFileA
GetPrivateProfileStringA
RemoveDirectoryA
lstrlenA
GetTempPathA
CreateMutexA
GetModuleFileNameA
CopyFileA
GetLastError
TerminateProcess
user32
FillRect
DrawTextA
SendMessageA
PtInRect
InvalidateRect
EndPaint
DestroyWindow
GetMessageA
ScreenToClient
RegisterClassExA
PostQuitMessage
LoadStringA
TrackMouseEvent
GetClientRect
BeginPaint
TranslateMessage
MessageBoxA
CreateWindowExA
TranslateAcceleratorA
EndDialog
DefWindowProcA
GetCursorPos
LoadAcceleratorsA
ShowWindow
DispatchMessageA
GetSystemMetrics
UpdateWindow
LoadCursorA
DialogBoxParamA
MoveWindow
LoadIconA
gdi32
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
SetBkMode
CreatePen
StretchBlt
SetTextColor
LineTo
GetObjectA
MoveToEx
GetStockObject
CreateFontIndirectA
CreateSolidBrush
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
shell32
SHFileOperationA
SHGetSpecialFolderPathA
SHChangeNotify
msvcr90
__CxxFrameHandler3
??3@YAXPAX@Z
??2@YAPAXI@Z
_access
_findnext64i32
_findclose
_findfirst64i32
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
memset
msvcp90
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ