F:\branches\5.7\RhinoProtect\Publish\OutPut\bin\Win32\release\pdb\2345SafeCenterInstaller.pdb
Static task
static1
Behavioral task
behavioral1
Sample
934a8add52269e21699da8e7b3602cfe_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
934a8add52269e21699da8e7b3602cfe_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
934a8add52269e21699da8e7b3602cfe_JaffaCakes118
-
Size
1.3MB
-
MD5
934a8add52269e21699da8e7b3602cfe
-
SHA1
ffcca7b8ccd01f1a52d373245a25fbe8ce792260
-
SHA256
54c747382757af3e5954feccce59b2134b7075bca4f1657b6c78f6e42664e1fb
-
SHA512
e780f6d674fb01d8e128267fea7fd9a58703b900f16d2d36a7fd33ee81b26692e236e3ba5ac17a9fe77efb0c02abaa45fa00e329fb938fafcb708ecb5502629d
-
SSDEEP
24576:K1ENjvqZcPPvfPcwNJMijDDnrAXghfh7TF+0qetrZc7xfIi5u:jTvfPcgnAXghfdTF+09rZc7xfIio
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 934a8add52269e21699da8e7b3602cfe_JaffaCakes118
Files
-
934a8add52269e21699da8e7b3602cfe_JaffaCakes118.exe windows:5 windows x86 arch:x86
f75b54c9d7f51b9294cfebff47ca9ff7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
kernel32
GetProcAddress
GetCurrentProcess
SetFilePointer
WriteFile
GetModuleFileNameW
CreateFileW
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
GetEnvironmentVariableW
LoadLibraryW
GetLogicalDriveStringsW
QueryDosDeviceW
HeapAlloc
HeapFree
GetModuleHandleW
GetProcessHeap
OpenProcess
LocalFree
GetPrivateProfileStringW
GetUserDefaultLangID
FreeLibrary
CloseHandle
GetLastError
CreateMutexW
GetTimeZoneInformation
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
VirtualQuery
FlushFileBuffers
GetOEMCP
ExpandEnvironmentStringsW
SearchPathW
GetDriveTypeW
GetFileAttributesW
FindFirstFileW
GetLongPathNameW
GetFileAttributesExW
GetDiskFreeSpaceW
GetVolumeInformationW
WideCharToMultiByte
GetACP
MultiByteToWideChar
lstrlenW
WaitForSingleObject
Sleep
ReleaseMutex
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
LoadLibraryExW
FindResourceW
LoadResource
GetVersionExW
LockResource
GetSystemInfo
lstrcmpiW
FindClose
FindNextFileW
GetFullPathNameW
GetTempFileNameW
MoveFileExW
CreateDirectoryW
SetFileTime
GetSystemDirectoryW
GetTempPathW
GetCurrentDirectoryW
MoveFileW
IsValidCodePage
RemoveDirectoryW
GetWindowsDirectoryW
DeleteFileW
SetFileAttributesW
GetFileSize
SetEndOfFile
ReadFile
GetFileTime
GetFileSizeEx
FormatMessageW
FileTimeToSystemTime
CreateProcessW
GetExitCodeProcess
WaitForMultipleObjects
GetTickCount
GlobalMemoryStatusEx
InterlockedExchangeAdd
SetEvent
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
ResetEvent
CreateEventW
InterlockedExchange
SetLastError
ResumeThread
DeviceIoControl
EncodePointer
GetStringTypeW
HeapReAlloc
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
RtlUnwind
GetSystemTimeAsFileTime
CreateThread
ExitThread
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
GetStdHandle
GetFileType
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
OutputDebugStringW
shell32
SHGetSpecialFolderPathW
SHGetFolderPathW
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 186KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ