d:\workspace\xiaobai.new\client\branch\release_3.0.0.0\gui\bin\setup\xiaobaisetup\Installer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
32930c828cc9c27b90aa58c61d436198_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
32930c828cc9c27b90aa58c61d436198_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
32930c828cc9c27b90aa58c61d436198_JaffaCakes118
-
Size
97KB
-
MD5
32930c828cc9c27b90aa58c61d436198
-
SHA1
0218000f5cf347fa87bd8470c6ce3fcdfc4956db
-
SHA256
56366da342eb5fb07b785a885a653e5e65471a633bb73c16f9c411d2f162dd4e
-
SHA512
2ac19cd9cac522a13f34dd167191e0a328231abe5411b5cfe497f98de3fbd80a9dd905584754bb6292d36c80951280728a7758fd1e5b8a75a16f7abb024636c2
-
SSDEEP
1536:WIJhXG6L3ECRb3Mu3SsUaqTmTEANL7kVmIOdnToIfapMt6mI:WIJM6wCRbykTEgVTBfapMt6D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32930c828cc9c27b90aa58c61d436198_JaffaCakes118
Files
-
32930c828cc9c27b90aa58c61d436198_JaffaCakes118.exe windows:4 windows x86 arch:x86
b85e02c79f3686e75286c1296d3b6f67
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
MessageBoxW
shlwapi
StrStrIW
shell32
SHCreateDirectoryExW
ShellExecuteW
kernel32
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CreateFileA
SetLastError
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
HeapSize
GetConsoleMode
GetConsoleCP
RtlUnwind
InitializeCriticalSection
LoadLibraryA
HeapReAlloc
VirtualAlloc
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LeaveCriticalSection
FindResourceW
LoadResource
GetCommandLineW
LockResource
SizeofResource
GetFileSize
ReadFile
GetModuleFileNameW
GetTickCount
CreateFileW
SetFilePointer
FreeResource
CloseHandle
WriteFile
GetLastError
GetCurrentProcessId
TerminateProcess
GetProcAddress
GetTempPathW
FindFirstFileW
WideCharToMultiByte
HeapAlloc
GetCurrentThreadId
Sleep
GetCurrentProcess
HeapFree
FindClose
OutputDebugStringW
GetProcessHeap
MultiByteToWideChar
GetVersionExA
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
RaiseException
EnterCriticalSection
Sections
.text Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ