C:\Users\marco\Documents\Trabajo\Workana\W00001\awf\Debug\ElswordDownloader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b573d4d0f077ef9cc625baf2a3054638_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b573d4d0f077ef9cc625baf2a3054638_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
b573d4d0f077ef9cc625baf2a3054638_JaffaCakes118
-
Size
2.3MB
-
MD5
b573d4d0f077ef9cc625baf2a3054638
-
SHA1
a0b02f8726c7d5d4bf740b846b6b0e39488ecf4e
-
SHA256
c092bf3038b99cd9d5b4a7bea08358f4df941c240f1b57995068014ab418250a
-
SHA512
69203f2bfbb3d70500579ac9992f9ec79385a9484a67457f87c97fc1ce43c5f646cbc32c9c4832a634cc4d5bd7f249dc78e78f1534b4d0d41302e61d6a992647
-
SSDEEP
24576:v7VWwEOTIjuCLp2auHLPZjpDNYm0HIidJJKC2Fj5E5v7CKv:v7VJEICwMTlKd8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource b573d4d0f077ef9cc625baf2a3054638_JaffaCakes118
Files
-
b573d4d0f077ef9cc625baf2a3054638_JaffaCakes118.exe windows:5 windows x86 arch:x86
e254c52ad31b8b8c1889a4844ef860ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
SetFilePointer
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
GetFileAttributesW
MultiByteToWideChar
WideCharToMultiByte
GetFileInformationByHandle
GetFileSize
GetLocalTime
FileTimeToSystemTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
WaitForSingleObject
Sleep
CreateProcessA
GetFileAttributesA
GetFileAttributesExW
GetDiskFreeSpaceExW
DeviceIoControl
CreateFileA
GetVersionExW
GetProcAddress
GetSystemInfo
lstrcmpiW
GetModuleFileNameA
GetModuleFileNameW
GetCommandLineA
GetTempPathA
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SleepEx
ExpandEnvironmentStringsA
FormatMessageA
FreeLibrary
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
LoadLibraryA
SetEndOfFile
SetEnvironmentVariableA
SetCurrentDirectoryW
GetFullPathNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetDriveTypeW
FindFirstFileExW
ReadFile
SetStdHandle
ReadConsoleW
InterlockedExchange
VirtualQuery
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
HeapAlloc
HeapQueryInformation
HeapSize
HeapReAlloc
HeapFree
MoveFileExW
DeleteFileW
OutputDebugStringA
WaitForSingleObjectEx
OutputDebugStringW
SetConsoleCtrlHandler
GetOEMCP
GetACP
IsValidCodePage
GetCurrentThread
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
WriteFile
DeleteTimerQueueTimer
CreateTimerQueueTimer
FindResourceW
GetModuleHandleW
SizeofResource
LoadResource
LockResource
GetTickCount
GlobalFree
GlobalAlloc
CreateMutexW
CloseHandle
GetLastError
CreateThread
TerminateProcess
ExitProcess
CompareStringW
GetFullPathNameA
GetTimeFormatW
GetDateFormatW
CreateSemaphoreW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
FatalAppExitA
InitializeCriticalSectionAndSpinCount
WriteConsoleW
FileTimeToLocalFileTime
SetFilePointerEx
ExitThread
GetCurrentThreadId
GetSystemTimeAsFileTime
FindClose
InterlockedExchangeAdd
LoadLibraryW
lstrlenA
LoadLibraryExW
HeapValidate
AreFileApisANSI
GetModuleHandleExW
IsProcessorFeaturePresent
IsDebuggerPresent
RtlUnwind
RaiseException
DecodePointer
EncodePointer
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetCurrentProcess
user32
MapWindowPoints
FindWindowW
SendMessageW
DefWindowProcW
PostQuitMessage
RegisterClassExW
CreateWindowExW
ShowWindow
FlashWindowEx
MoveWindow
SetWindowPos
SetCapture
ReleaseCapture
GetSystemMetrics
UpdateWindow
GetWindowRect
GetCursorPos
ScreenToClient
LoadIconW
SystemParametersInfoW
GetDesktopWindow
GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
PeekMessageW
MsgWaitForMultipleObjects
GetClientRect
GetWindowLongW
wsprintfW
IsWindowVisible
RedrawWindow
SetWindowLongW
SetWindowTextA
LoadImageW
SetClassLongW
SetWindowTextW
MessageBoxW
gdi32
PtInRegion
SetTextColor
SetBkMode
CreateSolidBrush
GetStockObject
CreateRectRgn
CreateFontW
advapi32
RegQueryValueExW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
shell32
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteW
SHBrowseForFolderA
ole32
OleUninitialize
CoGetClassObject
CoTaskMemAlloc
OleSetContainedObject
CoInitialize
CoCreateInstance
OleInitialize
oleaut32
SysAllocString
VariantClear
VariantInit
SafeArrayAccessData
SafeArrayDestroy
SafeArrayCreate
iphlpapi
GetAdaptersInfo
ws2_32
getaddrinfo
accept
ioctlsocket
__WSAFDIsSet
select
send
recvfrom
sendto
WSAStartup
gethostname
freeaddrinfo
WSAGetLastError
bind
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
recv
setsockopt
socket
WSASetLastError
listen
WSACleanup
comctl32
InitCommonControlsEx
Sections
.textbss Size: - Virtual size: 817KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 237KB - Virtual size: 237KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 349KB - Virtual size: 349KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ