F:\branches\6.1.5\RhinoProtect\Publish\OutPut\bin\Win32\release\pdb\2345SafeCenterInstaller.pdb
Static task
static1
Behavioral task
behavioral1
Sample
aaec0687a7cfe02b46f8214cccf269cb_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aaec0687a7cfe02b46f8214cccf269cb_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
aaec0687a7cfe02b46f8214cccf269cb_JaffaCakes118
-
Size
1.3MB
-
MD5
aaec0687a7cfe02b46f8214cccf269cb
-
SHA1
e643d71c72a43b84f64f9a142d2141e454770c3c
-
SHA256
ae72b4a6cda5f6fa5b57b2e527dbd4c092c68d94cd52f0131925d7e1ff7211b4
-
SHA512
b3507b9a5b2f0e8fcf3307dfce56c0d00e0cfe22f3df7f329b1113128e1d5660a463d7535180945d6b38e619e7ef81159bc7184344c17d4b55c132707d77abf8
-
SSDEEP
24576:oihLFMXJZqwpVJR2FouZM7ZRIGAdbdtGbKZCNf7uFTt+VFyJn8pCOWkMHcGVBYh:oyUfF2+uZM7CtoKEt7sTt+VFG8pCOWkn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aaec0687a7cfe02b46f8214cccf269cb_JaffaCakes118
Files
-
aaec0687a7cfe02b46f8214cccf269cb_JaffaCakes118.exe windows:5 windows x86 arch:x86
b6cb9359251738662571661beef10315
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
CloseHandle
GetCurrentProcess
SetErrorMode
MoveFileExW
HeapFree
WaitForMultipleObjects
WaitForSingleObject
OpenProcess
HeapAlloc
LocalFree
GetCurrentProcessId
GetProcessHeap
CreateProcessW
GetModuleHandleW
GetExitCodeProcess
QueryDosDeviceW
CreateMutexW
GetEnvironmentVariableW
GetLogicalDriveStringsW
VirtualQuery
GetPrivateProfileStringW
DeleteFileW
GetTickCount
MoveFileW
WriteFile
CreateFileW
GetUserDefaultLangID
GetModuleHandleExW
ReleaseMutex
Sleep
SetEnvironmentVariableA
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryW
FindFirstFileExW
SetStdHandle
HeapSize
WriteConsoleW
GetModuleFileNameW
FindClose
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetDriveTypeW
SearchPathW
ExpandEnvironmentStringsW
GetFileAttributesW
FindFirstFileW
GetLongPathNameW
GetFileAttributesExW
GetVolumeInformationW
GetDiskFreeSpaceW
GetACP
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
GetVersionExW
LockResource
GetSystemInfo
LoadResource
FindResourceW
lstrcmpiW
LoadLibraryExW
GetCurrentThreadId
GetComputerNameExW
ReadFile
SetFileTime
SetFilePointer
SetEndOfFile
GetFileSize
GetFileTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FindNextFileW
CreateDirectoryW
GetFullPathNameW
RemoveDirectoryW
GetTempPathW
SetFileAttributesW
GetCurrentDirectoryW
GetWindowsDirectoryW
CopyFileW
GetTempFileNameW
GetFileSizeEx
FormatMessageW
FileTimeToSystemTime
GlobalMemoryStatusEx
InterlockedExchangeAdd
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
CreateEventW
SetEvent
ResetEvent
InterlockedExchange
SetLastError
ResumeThread
DeviceIoControl
EncodePointer
GetCPInfo
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetLocalTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
ExitProcess
HeapReAlloc
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
FlushFileBuffers
IsValidCodePage
user32
wsprintfW
shell32
SHGetSpecialFolderPathW
SHGetFolderPathW
Sections
.text Size: 980KB - Virtual size: 980KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 237KB - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ