d:\core_rel\winclient\tools\CasinoSwitcher\Release\CasinoSwitcher.pdb
Static task
static1
Behavioral task
behavioral1
Sample
297b8a9fb4c58483d0d7010c4d6ccbe2_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
297b8a9fb4c58483d0d7010c4d6ccbe2_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
297b8a9fb4c58483d0d7010c4d6ccbe2_JaffaCakes118
-
Size
216KB
-
MD5
297b8a9fb4c58483d0d7010c4d6ccbe2
-
SHA1
c910e964bd9f4d3a2c158d52e192ed751a7f4581
-
SHA256
54730a126b99591609787fe0e352dd147b6e4b47afa1b5f069f6781a912f9d84
-
SHA512
3edbd4fdc8b93223f0544d98f157588e5fcc2dc6a9ab9a73a1a4fcf7cf7dbd383b3daa2cb2ee37879c194b82584e8254aa92ee03c04794d5434e32e288601ec8
-
SSDEEP
3072:afWNuuc9GBo7ZQiGt3oP8JEw/CdItSFo8dxNvmXw4:8WYuN3fJETIEFbNv6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 297b8a9fb4c58483d0d7010c4d6ccbe2_JaffaCakes118
Files
-
297b8a9fb4c58483d0d7010c4d6ccbe2_JaffaCakes118.exe windows:4 windows x86 arch:x86
2a76a596a6db8cfb5d779ea9e129399d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
wininet
HttpQueryInfoA
InternetReadFile
InternetConnectA
InternetSetOptionA
InternetAttemptConnect
InternetOpenA
HttpSendRequestA
InternetQueryOptionA
InternetCloseHandle
HttpOpenRequestA
InternetCrackUrlA
kernel32
LockResource
LoadResource
SizeofResource
FindResourceW
GetLastError
SetLastError
CreateThread
ExitProcess
GetVersion
GetProcAddress
FreeLibrary
InterlockedExchange
LoadLibraryA
CompareStringA
CopyFileA
CreateDirectoryA
CreateFileA
CreateProcessA
FindFirstFileA
FreeEnvironmentStringsA
GetEnvironmentStrings
GetFileAttributesA
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetStringTypeA
GetTempFileNameA
WideCharToMultiByte
GetVersionExA
GetWindowsDirectoryA
LCMapStringA
WritePrivateProfileStringA
GetStartupInfoA
GetOEMCP
GetACP
IsBadCodePtr
IsBadReadPtr
VirtualQuery
InitializeCriticalSection
SetStdHandle
SetHandleCount
GetCommandLineW
GetCommandLineA
UnhandledExceptionFilter
GetStdHandle
HeapSize
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCPInfo
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
TlsAlloc
IsBadWritePtr
MultiByteToWideChar
WaitForSingleObject
GetExitCodeProcess
CloseHandle
VirtualProtect
FlushFileBuffers
GetSystemInfo
GetTempPathA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapCreate
HeapFree
RtlUnwind
RaiseException
HeapReAlloc
HeapAlloc
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileType
HeapDestroy
user32
MessageBoxA
MessageBoxW
advapi32
RegSetValueExA
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
shell32
ShellExecuteA
Sections
.text Size: 84KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ