F:\VigjvrmptxOiu\ghXlpgoSac\jfLzfbZOkj\OpeSdDntvask\tGiXQIrmNNbjz.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2624682165a2652b44a8ae7fb6479dbd_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2624682165a2652b44a8ae7fb6479dbd_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2624682165a2652b44a8ae7fb6479dbd_JaffaCakes118
-
Size
144KB
-
MD5
2624682165a2652b44a8ae7fb6479dbd
-
SHA1
2a31e2391873233d1ea888613aba6ea37b5a132b
-
SHA256
c37bbe7ea887d9ed888d2a63c8b583a8979796f0e135811c64d0815d3d5cc5f8
-
SHA512
b73d4397fb844f3a349256ed1ad930377c4fa3e2052bc9fafb10ab3eb4e11eeec977abc23b2c146f2f8e23e17e07d888b9fea480abec2c9a288c8f2c07f8a611
-
SSDEEP
3072:4n791Zl2st0+qSxcimjoAjhDq+BfTappKEwTy:Y7DZl/hZG7DJfOOy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2624682165a2652b44a8ae7fb6479dbd_JaffaCakes118
Files
-
2624682165a2652b44a8ae7fb6479dbd_JaffaCakes118.exe windows:5 windows x86 arch:x86
c56bea9cff678c18c44b05d13c7a6d7d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
UrlGetPartW
ChrCmpIW
StrSpnA
ntdll
memset
gdi32
SetTextAlign
StretchDIBits
PatBlt
ExtTextOutA
DeleteDC
StartDocW
GetLayout
AddFontResourceW
GetTextExtentExPointW
CreateRectRgn
GetWindowOrgEx
StretchBlt
PtInRegion
MoveToEx
kernel32
lstrlenW
GlobalAlloc
SearchPathA
GetCommModemStatus
VirtualAlloc
GetSystemTimeAdjustment
FindFirstFileA
IsValidLocale
GetThreadContext
lstrcmpiW
LocalFree
GetDateFormatA
lstrcatA
GetSystemDirectoryW
FormatMessageW
CompareStringW
GlobalAddAtomA
msvcrt
exit
user32
GetTopWindow
GetLastActivePopup
SendDlgItemMessageA
GetMenuItemCount
FindWindowW
DispatchMessageA
LoadIconA
SetDlgItemInt
ModifyMenuW
GrayStringW
PostMessageA
GetDlgCtrlID
DialogBoxParamA
GetFocus
GetClassInfoA
CopyRect
GetClassInfoExA
SendInput
DestroyIcon
IsDialogMessageW
LoadCursorW
DrawStateW
UnionRect
MapDialogRect
SetClassLongW
CheckRadioButton
CharUpperA
MessageBoxExW
GetDialogBaseUnits
GetMenuState
Exports
Exports
?GY_OUKIurfdulFFj@@YGPAIPAJF@Z
?qNEqgvp_NUJa_nqajKl@@YGXF@Z
?FPX_tajmc___docS@@YGHPAEPAK@Z
?asylZEMByv@@YGDPAFG@Z
?tZBSMRajxp_qJA_XXCJ@@YGDNPAM@Z
?SQPU_H_it@@YGIN@Z
?hhwknjJ__XQ_@@YGXD@Z
?zpo___i_ioLhgzjeolbmX@@YGJPAJH@Z
?DT_H_r___aGP___IV@@YGPADIM@Z
?WGQIUICUT_P____Nmot@@YGIK@Z
?ziSOG__GUT_WLJR_@@YGDHPAG@Z
?rcgq_qlcs@@YGJGPAM@Z
?US_DYNVHL__UduWRCAD@@YGXE@Z
?__v_yxelWPox@@YGPANPAGF@Z
?s_ghu_sNRYGMNPVnnc@@YGEF@Z
?_joKXZ_IA_c_pr@@YGPAKF@Z
?io_zopzqztlxkE_DMLT@@YGPAHH@Z
?zbqibFW__W__T@@YGPANPAH@Z
?KSZ_TIUAVe_yoah_F@@YGMPAJD@Z
?KHTSWSMHJX_VYJU_KLL@@YG_NPAM@Z
?gd_pMLFIFBOR_RPUOCQLI@@YGXPAF@Z
?_A_RPy_QLnriol_hf_e@@YGXPA_NPAJ@Z
?v_om__aIMHb_aN_EG_DBH@@YG_NPAEE@Z
?vtctoyPIM_w_@@YGDMK@Z
?hxwNXWBRvnp@@YGMDM@Z
?_kaft_sEFK_I@@YGMPAFM@Z
?SA__t__t_@@YGFEJ@Z
?feq_jUUJHWN_PVYibclCE@@YGEGPAF@Z
?lmtecbkinhdj@@YGX_NK@Z
?theSAURHK_FU___NVGNFP@@YGPAKI@Z
?LJX_MI_vb_bqx_dfKZ_@@YGPA_NFJ@Z
?bmcvexirltp_dtXj@@YGPAXF@Z
?LSpz_mNC@@YGPAEMPAD@Z
?mzjfs_uljcv____k@@YGFN@Z
?OCEtrvf___E_XD_SI_ylS@@YGPAJJG@Z
?GIMNL_MEWKR@@YGDDG@Z
?PYRMEXGoV_L@@YGPAXD_N@Z
?ZXT_UV____Vd_e@@YGE_N@Z
?WX_ZX_q_ufmoue_@@YGGE@Z
?iitt_cB_VSQ__e@@YGKI@Z
?U_LDIAG__A_@@YGXE@Z
?__pmBVVNHR_zlkgybe_l_@@YGPAFI@Z
?egiVC_YOzuwffjulz@@YGJME@Z
?XJ_ATCOKp_mgn@@YGXI@Z
?mJKIeubi_zc_jp@@YGXPAK@Z
?E_G___tra_cv@@YGXDG@Z
?bime_gkgmEBNr_fv@@YGPAXJ@Z
?kfnh_furw@@YGMDE@Z
?dbzz_gqGYB_@@YG_NHD@Z
?ABIV_NI___zh__EWW@@YGMM@Z
?kpmb__sCQSYECLVYRio@@YGGHPAK@Z
?epj_cvJC_Rfi@@YGJIE@Z
?VGXA_UZDh_eXCTG@@YGFPADD@Z
?Sn_gk_l_oua_ix@@YGPAXPAID@Z
?y_hy__thT_SL@@YGI_NPAK@Z
?D_wfrx__x_y_hO_@@YGXPADF@Z
?_v___lhruat_w@@YGNM@Z
?w_gjzu_xro__@@YGPADJK@Z
?oz__t_axd_ovf@@YGKK@Z
?_Zj_saie_LEBBKS__HZI_K@@YGKDF@Z
?vvALPRPHSvmmfoygae@@YGXHM@Z
?__NBQUExijOX@@YGPAKE@Z
?TVTPT_OK@@YGXIN@Z
?juv_pdC@@YG_NPAEPAH@Z
?NGQLLp_lNQSP__@@YGXPA_NM@Z
?wJYFCsu_bcc_f@@YGPAXPAFI@Z
?Ukq_nsV_@@YGKI@Z
?PP_R__QGB@@YGEPAKH@Z
?__x_dfz_oASV_Haxfj_e@@YGGPAEH@Z
?gvli__aE__K_teVTSAxi@@YGXGPAJ@Z
?ncqb_aUUKO_ES_RSZ@@YGPADPAH@Z
?YFJNem_udg_wj_aknl@@YGGDJ@Z
?ikwnxthmt@@YGDPAHH@Z
?b__fwcqcoDBX_l_z@@YGHM@Z
?_OKORL_m@@YGHPAM@Z
?qTAy__ggSG@@YGGPANF@Z
?mg_nOQI_MZQtxs@@YGIPAIM@Z
?C_FCAlxgn@@YGPANPAFPAK@Z
?_vxrcnxoo@@YGPAJPAF@Z
?YPzwNJB_I@@YGPAXPAHPAF@Z
?_te_vx_zjze@@YGPAXM@Z
?KZIO_UCPUeXDCD__I__evQ@@YGPAXIG@Z
?__ZREGWPRAj_bFO_DV@@YGX_N@Z
?__Qa______krpU_Nhfl_y@@YGPAEK@Z
?K_z_zojo_tn_xIS@@YGDPAD@Z
?IN_Pjxv_ef_b_jmt_bpw@@YGKMI@Z
?vuxisdspkxuA@@YGMEM@Z
?nb_J_FELdwaGCBC_Xz@@YGKK@Z
?rmMCHEpzk_bzw_hF__@@YGPAXPA_N@Z
?JKwba__k___ej__vfV_@@YGJIK@Z
?di_vPFDP_BIBHNNPekaEN@@YGNEK@Z
?iRCXKHPy_i_lcdiptgt_ne@@YGFE@Z
?_urgBA_NC@@YGIPA_N@Z
?C_VY_IKV@@YGHIPAH@Z
?m_dxugd_oj_xV_N@@YGPAKPAK@Z
?_RPrd_l_p__xs_@@YGEPAJ@Z
?fjto__Efm_D_S@@YGXPAFE@Z
?_EUX_OLkavGP_HIUHA@@YGPAM_N@Z
?VKHdv__sf@@YGXF@Z
?u_ylr_uN_s_vkzcz@@YGEEG@Z
?jroqJekXTNLlY_K@@YGJFF@Z
?GJIS_KrFbMFFAV_MB@@YGIPAH@Z
?VD__HJZ__XT@@YGKPAI@Z
?_vgcIEA__MAJWQ@@YGKJ@Z
Sections
.text Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ldata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 28KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ