e:\_Program\发布配置区\exe文件运行绑定器\exe分发运行机母鸡.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2378c1da0fa5ca0309e7cf52cbdd048b_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2378c1da0fa5ca0309e7cf52cbdd048b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2378c1da0fa5ca0309e7cf52cbdd048b_JaffaCakes118
-
Size
828KB
-
MD5
2378c1da0fa5ca0309e7cf52cbdd048b
-
SHA1
5504365a2a3e3b70b27ae33a3d40c9d864e3a338
-
SHA256
9272a046f614b1ecb622603b165b0112d017dd83a8297a7cc6b7c0ac7cc63ad4
-
SHA512
2f11175ccfbe5a415bcd964f4f0f83fd7cee95cc7c384048a10dd24f1f45e64e4f643338303dfb3ccaad0ac129be49ef583845d4cf3c64d98538fc61b45d54d5
-
SSDEEP
24576:L5gMUVCEKeg57LUGQ5dqE8BHIV83G4Q8YcrgwXk:3UVCPey7YfdqEQC83PQX1wU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2378c1da0fa5ca0309e7cf52cbdd048b_JaffaCakes118
Files
-
2378c1da0fa5ca0309e7cf52cbdd048b_JaffaCakes118.exe windows:4 windows x86 arch:x86
7eab902e66cd68b9c246b9343ce27479
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
TerminateProcess
FileTimeToSystemTime
GetLastError
SetLastError
LocalFree
FreeLibrary
lstrlenW
GetProcAddress
LoadLibraryA
GetCurrentProcessId
ExitProcess
GetModuleHandleA
GetTempPathA
GetFileAttributesA
SetFileAttributesA
SetPriorityClass
HeapAlloc
HeapFree
GetTickCount
GetCurrentThread
GetProcessHeap
GetCommandLineA
SetProcessPriorityBoost
lstrcatA
GetEnvironmentVariableA
SetThreadPriority
GetShortPathNameA
GetModuleFileNameA
GetVersionExA
lstrcpyA
FindResourceA
FreeResource
LoadResource
LockResource
LoadLibraryExA
FindFirstFileA
FindClose
FindNextFileA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
HeapSize
RtlUnwind
InitializeCriticalSection
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RaiseException
GetCurrentProcess
Sleep
lstrlenA
CloseHandle
WriteFile
SetFilePointer
CreateFileA
MultiByteToWideChar
GetSystemDirectoryA
InterlockedDecrement
WideCharToMultiByte
SizeofResource
GetStdHandle
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
LCMapStringW
LCMapStringA
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
HeapReAlloc
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
user32
GetClassNameA
GetParent
GetWindowTextA
GetDesktopWindow
EnumChildWindows
shell32
SHGetSpecialFolderLocation
SHChangeNotify
SHGetPathFromIDListA
ShellExecuteExA
ole32
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
OleRun
oleaut32
VariantInit
VariantClear
SysFreeString
oleacc
WindowFromAccessibleObject
AccessibleObjectFromWindow
GetRoleTextA
Sections
.text Size: 64KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736KB - Virtual size: 734KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ