c:\googleclient\picasa39-stable\payloadXML.pdb
Static task
static1
Behavioral task
behavioral1
Sample
44b310b7bd8db3821d8d0edae5ddd862_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
44b310b7bd8db3821d8d0edae5ddd862_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
44b310b7bd8db3821d8d0edae5ddd862_JaffaCakes118
-
Size
195KB
-
MD5
44b310b7bd8db3821d8d0edae5ddd862
-
SHA1
1410a86bdae80a3c8218559d48b3b7c49c03bf99
-
SHA256
b97d0b5ec952befd56c59bfcff23f2e7084ea19c46fb796f9f25f9cf3a7aee33
-
SHA512
7b7d0f4ec22f27d1c0d3d3204bece6888b85b07a3ffa491d9fbd6ace005180692e0bc0af424167aba8663359925d7937a60dc767e2171ae8ec61583eaafd7b30
-
SSDEEP
3072:3CfzqDU+N5/EHXxlt/JrCfzqDU+N5/EHXt:3C7qDU+4xXJrC7qDU+4t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44b310b7bd8db3821d8d0edae5ddd862_JaffaCakes118
Files
-
44b310b7bd8db3821d8d0edae5ddd862_JaffaCakes118.exe windows:4 windows x86 arch:x86
fd84ca43b42f0a9dd16b55725642cae6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathAddBackslashA
urlmon
URLDownloadToFileA
wintrust
WinVerifyTrust
kernel32
RaiseException
lstrcmpW
GetLastError
MultiByteToWideChar
GetProcAddress
LoadLibraryA
GetModuleFileNameA
WriteFile
CreateEventA
MoveFileA
GetCurrentThreadId
GetUserDefaultLangID
CopyFileA
GetExitCodeThread
LockResource
GetModuleHandleA
CloseHandle
GetFileAttributesA
FindResourceExA
SetFileAttributesA
GlobalAlloc
GetExitCodeProcess
CreateMutexA
GlobalFree
GetTempFileNameA
GetTempPathA
ResetEvent
CreateFileA
CreateDirectoryA
OpenMutexA
FindResourceA
WaitForSingleObject
Sleep
DeleteFileA
CreateThread
LoadResource
SizeofResource
SetEvent
FreeLibrary
GetCurrentProcessId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
TerminateProcess
OpenProcess
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
HeapSize
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
InitializeCriticalSection
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
ExitProcess
LCMapStringW
WideCharToMultiByte
LCMapStringA
FlushFileBuffers
lstrlenA
IsValidCodePage
GetOEMCP
GetCPInfo
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapFree
GetSystemTimeAsFileTime
GetCommandLineA
HeapAlloc
GetProcessHeap
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
user32
MessageBoxA
IsWindow
FindWindowA
GetClassNameA
EnumWindows
SetWindowTextA
GetWindowLongA
LoadIconA
LoadStringW
UpdateWindow
KillTimer
DestroyWindow
MsgWaitForMultipleObjects
DispatchMessageA
SetWindowPos
SetWindowLongA
DialogBoxParamA
SetClassLongA
ShowWindow
SetWindowTextW
GetMessageA
IsDialogMessageA
TranslateMessage
GetDlgItem
GetSystemMetrics
EndDialog
CreateDialogParamW
SetTimer
GetWindowRect
SendMessageA
advapi32
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegDeleteValueA
shell32
ShellExecuteA
ShellExecuteExA
ole32
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocStringLen
Sections
.text Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14.1MB - Virtual size: 14.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ