e:\TFS\Z1\Releases\2.33.1\SourceInt\Zu\rueck\Release\rueck.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0c8609886dfd73bd8ff5542515ceb98b_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0c8609886dfd73bd8ff5542515ceb98b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0c8609886dfd73bd8ff5542515ceb98b_JaffaCakes118
-
Size
8KB
-
MD5
0c8609886dfd73bd8ff5542515ceb98b
-
SHA1
aa0fff1047d77e5b7259681899351d1f84994cc9
-
SHA256
91ed6780f8fa031a6089979b4c5d334663b39fa4c38ccb3b89f37288e3e0701b
-
SHA512
f332237e4e92a0bd3868aba6becce0c140e62f86dbda235ff8a845e84616e65f67516755570e899eee17386082028ad7360f04f12b0ddf99d6815ba68baea440
-
SSDEEP
96:SPvS+ghTB8AnWg0Qq8dzLDRcZH5/+Ahjsno2aouhjwOJJGI+kqESCPtCf:SH4pB8AnV0OeZH5/+kcR0kOJJ9tqEG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c8609886dfd73bd8ff5542515ceb98b_JaffaCakes118
Files
-
0c8609886dfd73bd8ff5542515ceb98b_JaffaCakes118.exe windows:5 windows x86 arch:x86
598e272c4a614d6cf33648ea7c494675
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetProcAddress
GetModuleHandleA
CloseHandle
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
CreateProcessA
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
user32
MessageBoxA
advapi32
RegCreateKeyExA
RegCloseKey
RegSetValueExA
msvcr90
_configthreadlocale
__setusermatherr
_adjust_fdiv
_initterm_e
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
sprintf_s
__p__commode
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 916B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 700B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ