c:\users\aptem\documents\visual studio 2013\Projects\Win32Project2\Release\Win32Project2.pdb
Overview
overview
3Static
static
3SFX Creator.exe
windows7-x64
3SFX Creator.exe
windows10-2004-x64
3SYS/dll/icons.dll
windows7-x64
1SYS/dll/icons.dll
windows10-2004-x64
1SYS/dll/resources.dll
windows7-x64
1SYS/dll/resources.dll
windows10-2004-x64
1User/icons.dll
windows7-x64
1User/icons.dll
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
SFX Creator.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
SFX Creator.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
SYS/dll/icons.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
SYS/dll/icons.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
SYS/dll/resources.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
SYS/dll/resources.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
User/icons.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
User/icons.dll
Resource
win10v2004-20240226-en
General
-
Target
7ebc1d14cc871ecfeb6c150e14573e58_JaffaCakes118
-
Size
812KB
-
MD5
7ebc1d14cc871ecfeb6c150e14573e58
-
SHA1
8410c1a6f9d0a217a769b0514e03a4edcfa04b41
-
SHA256
e3f76ff245d3326e2cd376216085336dfe4c232cd81ac0d8f1a61d20744283a9
-
SHA512
2015f42a2df91feac00b07cbdcb2a9473b16b490c4fe23095231448525c56980e5bb9f186d3ab45b4aeef6d18495aa813121ca8aa4971e134787afe38339a1b2
-
SSDEEP
24576:R7oxbCI/RsuboDpflaWz54BDFPVpW9bi5OikOqaBYPI2:RKb5sNt4pbpyGwO52
Malware Config
Signatures
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/SFX Creator.exe unpack001/SYS/dll/icons.dll unpack001/SYS/dll/resources.dll unpack001/User/icons.dll
Files
-
7ebc1d14cc871ecfeb6c150e14573e58_JaffaCakes118.zip
-
SFX Creator.exe.exe windows:5 windows x86 arch:x86
8d10f0060da0fe633f85cc8444aa845e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
Shell_NotifyIconA
SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA
DragFinish
DragQueryFileA
SHGetFileInfoA
ShellExecuteA
DragAcceptFiles
SHFileOperationA
shlwapi
PathFindExtensionA
PathRemoveFileSpecA
PathFileExistsA
PathFindFileNameA
comctl32
ImageList_Destroy
InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Create
ord17
uxtheme
SetWindowTheme
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
kernel32
CreateFileA
FreeLibrary
HeapAlloc
GetCurrentProcess
HeapFree
GetTickCount
GetProcessHeap
Sleep
CreateProcessA
TerminateProcess
CreateDirectoryA
GetLastError
GetProcAddress
GetPrivateProfileStringA
LoadLibraryA
WritePrivateProfileStringA
MoveFileA
GetModuleFileNameA
GetModuleHandleA
IsDebuggerPresent
CloseHandle
GetCurrentProcessId
DeleteFileA
WriteFile
ReadFile
CreateThread
FindFirstFileA
lstrcmpA
GetFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindNextFileA
FindClose
GetVersionExA
WaitForSingleObject
ExitProcess
GetStartupInfoA
SetEnvironmentVariableA
GetExitCodeProcess
PeekNamedPipe
lstrcatA
lstrcpynA
lstrlenA
GetFileAttributesA
GetFullPathNameA
GetPrivateProfileSectionA
MultiByteToWideChar
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DecodePointer
GetUserDefaultLCID
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcpyA
ExitThread
RtlUnwind
HeapReAlloc
LoadLibraryExW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LeaveCriticalSection
EnterCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetFileType
GetCurrentThreadId
GetModuleFileNameW
GetStdHandle
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapSize
WideCharToMultiByte
LCMapStringW
GetModuleHandleExW
GetCommandLineA
IsProcessorFeaturePresent
EncodePointer
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
OutputDebugStringW
SetStdHandle
WriteConsoleW
GetStringTypeW
FlushFileBuffers
CreateFileW
CreatePipe
ReadConsoleW
user32
IsWindow
OpenClipboard
GetClipboardData
CloseClipboard
CharNextA
EmptyClipboard
SetClipboardData
RedrawWindow
SetTimer
KillTimer
IsWindowVisible
DestroyMenu
IsIconic
ScreenToClient
SetMenu
AppendMenuA
InsertMenuA
GetMenuStringA
CreateMenu
CreateDialogParamA
SetForegroundWindow
wsprintfA
EnableWindow
GetDlgItemTextA
SetDlgItemTextA
LoadImageA
GetDlgItem
DialogBoxParamA
EndDialog
PostQuitMessage
EnumChildWindows
ChangeWindowMessageFilterEx
EndPaint
BeginPaint
SetWindowTextA
GetClientRect
SystemParametersInfoA
TrackPopupMenu
GetCursorPos
SendDlgItemMessageA
CreatePopupMenu
MoveWindow
LoadCursorA
FindWindowA
UpdateWindow
GetSystemMetrics
DispatchMessageA
ShowWindow
RegisterClassA
LoadBitmapA
UpdateLayeredWindow
GetMonitorInfoA
MonitorFromPoint
DefWindowProcA
DestroyIcon
ReleaseCapture
GetParent
PostMessageA
ClientToScreen
SetCapture
PtInRect
GetWindowRect
CallWindowProcA
GetWindowLongA
DrawTextA
GetSysColorBrush
FillRect
DrawEdge
GetWindowDC
OffsetRect
SetWindowPos
SetWindowLongA
GetMessageA
RegisterClassExA
DrawIconEx
SetMenuItemBitmaps
LoadIconA
SendMessageA
GetIconInfo
GetDC
TranslateMessage
SetRect
MessageBoxA
CreateWindowExA
ReleaseDC
TranslateAcceleratorA
GetDesktopWindow
gdi32
SetTextColor
GetDeviceCaps
GetObjectA
SetBkMode
DeleteDC
CreateDIBSection
GetDIBits
SetBkColor
DeleteObject
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
GetStockObject
ExtTextOutA
CreateSolidBrush
CreateFontA
comdlg32
GetOpenFileNameA
ChooseColorA
GetSaveFileNameA
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ole32
CoInitialize
wininet
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
DeleteUrlCacheEntry
InternetCloseHandle
InternetConnectA
InternetOpenA
urlmon
URLDownloadToFileA
Sections
.text Size: 260KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 433KB - Virtual size: 433KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
SYS/dll/icons.dll.dll windows:6 windows x86 arch:x86
89a6d69512ddd5caf6edc165bcb08fbf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WriteFile
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
CreateFileW
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 318KB - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
SYS/dll/resources.dll.dll windows:6 windows x86 arch:x86
89a6d69512ddd5caf6edc165bcb08fbf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
c:\users\aptem\documents\visual studio 2013\Projects\Win32Project2\Release\Win32Project2.pdb
Imports
kernel32
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WriteFile
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
CreateFileW
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 903KB - Virtual size: 904KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
User/icons.dll.dll windows:6 windows x86 arch:x86
89a6d69512ddd5caf6edc165bcb08fbf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
c:\users\aptem\documents\visual studio 2013\Projects\Win32Project2\Release\Win32Project2.pdb
Imports
kernel32
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WriteFile
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
CreateFileW
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ