d:\p4_cougar.nero.com1666_de-c-w-318\source\main\deployment\is\installer\assets\prerequisites\prqstarter\target\checkout\target\classes\x86\release\PRQStarter-1.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4acf79363e1d33a3999307dc2ca637a1_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
4acf79363e1d33a3999307dc2ca637a1_JaffaCakes118
-
Size
224KB
-
MD5
4acf79363e1d33a3999307dc2ca637a1
-
SHA1
d83784bf0e5e82c324c3d62ebeae7f3c9e230397
-
SHA256
fc8016665601b140bf23991fcbdd4ac6e1396cfc9ac45c725ea29ca6bbc8e24a
-
SHA512
26cfc10d734eff8093a86abb201f81051593edc50c46437ba35915faef74dc164a7b1c83258621f6ecd802b4a91df43155b21eaaa9e0924734dbe03e93bde60a
-
SSDEEP
3072:6u8A9AgUQ4gcbM7e6rXZkHKQXOOXRwm1gsKyZLchU+R0dFIN8BIoRGL/HsIv+:H2/bM1eHlOOqCjKYY++IRGL32
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4acf79363e1d33a3999307dc2ca637a1_JaffaCakes118
Files
-
4acf79363e1d33a3999307dc2ca637a1_JaffaCakes118.exe windows:4 windows x86 arch:x86
b7ad2f25da211691371fd104af7e32f4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FindResourceExW
LocalFree
CloseHandle
WriteFile
GetCurrentDirectoryW
ResumeThread
GetTempPathW
GetTempFileNameW
CreateFileW
WaitForSingleObject
TerminateThread
FindResourceW
FlushFileBuffers
CreateFileA
WriteConsoleW
GetCommandLineW
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
LoadLibraryA
SetEnvironmentVariableA
CompareStringW
CompareStringA
LoadResource
LockResource
SizeofResource
GetLastError
GetExitCodeProcess
GetConsoleOutputCP
LocalAlloc
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
VirtualAlloc
GetSystemTimeAsFileTime
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCurrentThreadId
CreateThread
GetStartupInfoW
WideCharToMultiByte
GetProcAddress
GetModuleHandleA
ExitProcess
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
user32
LoadIconW
LoadStringW
MessageBoxW
MoveWindow
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
PeekMessageW
PostQuitMessage
MsgWaitForMultipleObjects
SendDlgItemMessageW
LoadAcceleratorsW
EndDialog
UnregisterClassA
GetDlgItem
EndPaint
BeginPaint
DefWindowProcW
DestroyWindow
DialogBoxParamW
UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
advapi32
RegCreateKeyExW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
shell32
ShellExecuteExW
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
Sections
.text Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.1rdata Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE