U:\pyqpkKj\wemSHpuu\txpunpuu\XvDjoIxlaskyL\ZtMonvvg.pdb
Static task
static1
Behavioral task
behavioral1
Sample
36cfa79d7b883c4ebc5159691aee90c5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
36cfa79d7b883c4ebc5159691aee90c5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
36cfa79d7b883c4ebc5159691aee90c5_JaffaCakes118
-
Size
614KB
-
MD5
36cfa79d7b883c4ebc5159691aee90c5
-
SHA1
fa561425f1d19f043e180a48ea2d55eafb11cee2
-
SHA256
d8b8d4f336a7362702a9902fab3d5411c5457898eaf00c749e55b1bfa530dfe3
-
SHA512
43c63e2559437f202b3ba3e8a3445b02311b3e97b8c461170e9b525d16f24e0645ebabad6a57604f4f4bfa5e629a8ff6eeb5239c17315dd96967a61de2f06515
-
SSDEEP
12288:8xBqBZ4T2nMHpyyBJqh01oA/7GshPw+Rl+vol6WzwKBcLj:8POZE2n8pyX87rw+KvlCO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36cfa79d7b883c4ebc5159691aee90c5_JaffaCakes118
Files
-
36cfa79d7b883c4ebc5159691aee90c5_JaffaCakes118.exe windows:5 windows x86 arch:x86
6cfbd530849bdae9e65cc3a8cdea9591
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
StrDupW
gdi32
ExcludeClipRect
GetClipBox
SetDIBits
SetBitmapBits
GetSystemPaletteUse
CreateDIBSection
CreateFontW
GetTextFaceW
ExtTextOutA
CombineRgn
GetTextExtentPointW
SetRectRgn
OffsetRgn
msvcrt
exit
kernel32
SetNamedPipeHandleState
GetTempFileNameA
ExitThread
IsDBCSLeadByte
lstrcpynW
GetFileAttributesExA
GetCurrentProcessId
LoadLibraryW
GlobalFree
FindFirstFileA
GlobalSize
SetupComm
GetLocaleInfoW
GlobalDeleteAtom
lstrcatW
ExitProcess
GetVersionExW
user32
DrawStateW
GetClipCursor
CharToOemW
DeferWindowPos
UnionRect
CreateCaret
GetMenuStringW
InvalidateRgn
ClipCursor
CharPrevW
EnableMenuItem
RegisterClassA
DrawFrameControl
AdjustWindowRect
CheckMenuRadioItem
SetWindowTextW
TranslateAcceleratorA
LockWindowUpdate
GetLastActivePopup
ScreenToClient
LoadAcceleratorsA
DrawTextA
FindWindowExA
LookupIconIdFromDirectory
DefDlgProcW
DrawStateA
TabbedTextOutW
RemovePropW
Exports
Exports
?_wldy_vEI_EZrybj_ibjfY@YGII_N@Z
Sections
.text Size: 580KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.form1 Size: 512B - Virtual size: 350B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.form2 Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.form3 Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.form4 Size: 1024B - Virtual size: 602B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.info Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ