D:\pulse\recipes\205785143\base\branches\protector_release_branch\googleclient\tactical\protector\build\opt\obj\loader\GoogleToolbarNotifier_unsigned_exe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2352314cec4e194956353f35c1e9ed59_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2352314cec4e194956353f35c1e9ed59_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2352314cec4e194956353f35c1e9ed59_JaffaCakes118
-
Size
98KB
-
MD5
2352314cec4e194956353f35c1e9ed59
-
SHA1
f97dd30fc3460ac55a5c1afd2cf77a18da85df29
-
SHA256
58829e8b4a914463a9e9787cb4edeaa7dc08e3dba7df21f2f35c72639d4f0d2d
-
SHA512
562afc9d85e7abb71f52a03f507192fde132ae9879651bbbed6056684010b484a20b874c3bf9f04922b25de6411fbf584e60fdcb1f6e24a52330f49c03fbfd76
-
SSDEEP
1536:iN8+8hKZzvzjXlVWF7yIdT+Tn8P0xi/yOkubQbbtJwlmOf+RG1yAZLhoC6RTUhl:k8+CKZz7r+WQOn2x/yfrM+RG1zd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2352314cec4e194956353f35c1e9ed59_JaffaCakes118
Files
-
2352314cec4e194956353f35c1e9ed59_JaffaCakes118.exe windows:4 windows x86 arch:x86
f6db73f769f56f9300c9aabd86321558
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
ExitProcess
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
GetCommandLineW
FreeLibrary
GetModuleFileNameW
CompareStringW
lstrlenW
GetProcAddress
lstrcmpiW
GetProcessHeap
HeapFree
LoadLibraryW
HeapAlloc
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 934B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rrdata Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE