A:\WindowsProcessManager-master\WindowsProcessManager-master\Release\TaskMgr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
55eb163e5b4d38501f50d892af82bd8b_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
55eb163e5b4d38501f50d892af82bd8b_JaffaCakes118
-
Size
145KB
-
MD5
55eb163e5b4d38501f50d892af82bd8b
-
SHA1
db5e684a0f8d0b8183419795ea902112ea1e42b4
-
SHA256
4d7b9e809d7f8dffec93d97b1ba150e1561e506279f5ffba92bef13e7ebe378a
-
SHA512
bc280414c53a2b1fa02dae93c07c7555307bc9ad632c75ed995f3ea2c04371f2deaba6ccb7ae77a0d2f9352a9e498721746c0645ea80e10c411be862648c9654
-
SSDEEP
3072:kyYIilXVCZV4xqbqP1AjTPsjuHY1qUycOo9EdAPioPZrnghGLOrigrcGN2:7zoMVuqePSHsKKOo9EdAPXPZLGGarmG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 55eb163e5b4d38501f50d892af82bd8b_JaffaCakes118
Files
-
55eb163e5b4d38501f50d892af82bd8b_JaffaCakes118.exe windows:5 windows x86 arch:x86
fb07d04bdc5b2c60e496d1ee84f41509
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
VirtualAlloc
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
CreateProcessW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
TerminateProcess
OpenProcess
QueryFullProcessImageNameW
CloseHandle
GetCurrentProcess
GetLastError
FormatMessageW
QueryPerformanceCounter
ExitProcess
user32
SendMessageW
DefWindowProcW
CreateWindowExW
wsprintfW
GetMessageW
UpdateWindow
SetTimer
RegisterClassExW
LoadCursorW
LoadIconW
TranslateMessage
DispatchMessageW
PostQuitMessage
ShowWindow
MessageBoxW
SetWindowTextW
GetWindowTextW
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupAccountSidW
GetTokenInformation
GetUserNameW
LookupPrivilegeValueW
msvcp90
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
comctl32
InitCommonControlsEx
psapi
GetProcessMemoryInfo
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
msvcr90
_invoke_watson
_controlfp_s
_lock
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
wcschr
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
__setusermatherr
??3@YAXPAX@Z
??0exception@std@@QAE@XZ
__CxxFrameHandler3
wprintf
??_V@YAXPAX@Z
wcsncpy
_wcsdup
memset
malloc
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
_unlock
__dllonexit
_encode_pointer
??1exception@std@@UAE@XZ
_onexit
_decode_pointer
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
Sections
.text Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ