x:\Projects\CashBackAssistant\Product\trunk\PixelLog\PixelLog\Release (PROD)\bin\setup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4d6df64ad8c7c1478318c2b0e514957f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4d6df64ad8c7c1478318c2b0e514957f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4d6df64ad8c7c1478318c2b0e514957f_JaffaCakes118
-
Size
184KB
-
MD5
4d6df64ad8c7c1478318c2b0e514957f
-
SHA1
700f578c93a2266650d54d3685f4678e3e211f20
-
SHA256
c02b1d899fd55ffeaaeb6f95926e27ee2245935e77b0aa8dad65ec8f092ea190
-
SHA512
07f4375c355dd43b3b9ff2148156c46ff0d832011a8629c5676e09409248f5b15d838482026d6fbc3b61462c6f64d8edfd2e21c01fc9efecac55343aee7ad3af
-
SSDEEP
3072:LNiv15gZ83emBLv6blnrcq8+zYWe1W2nTn8liDtJPW:g1I8ib8H+2T8wPW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d6df64ad8c7c1478318c2b0e514957f_JaffaCakes118
Files
-
4d6df64ad8c7c1478318c2b0e514957f_JaffaCakes118.exe windows:4 windows x86 arch:x86
58e0898d0785443e011a751125916697
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
SetEndOfFile
CreateThread
CloseHandle
SetLastError
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapFree
GetProcessHeap
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
WideCharToMultiByte
VirtualAlloc
HeapSize
WriteFile
GetStdHandle
GetModuleFileNameA
LoadLibraryA
Sleep
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
GetLocaleInfoW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CreateFileW
GetVersionExW
ReleaseMutex
WaitForSingleObject
CreateMutexW
DeviceIoControl
lstrlenA
InterlockedIncrement
GetLastError
SetFilePointer
ReadFile
CreateFileA
InterlockedDecrement
lstrlenW
MultiByteToWideChar
user32
KillTimer
DispatchMessageW
TranslateMessage
LoadStringW
UnregisterClassA
GetMessageW
SetTimer
ole32
CoCreateInstance
CoUninitialize
OleRun
CoInitializeEx
oleaut32
VariantClear
GetErrorInfo
SysFreeString
SysAllocString
wininet
InternetConnectW
InternetCloseHandle
HttpQueryInfoA
InternetSetOptionW
InternetQueryOptionW
HttpSendRequestA
HttpOpenRequestW
InternetOpenA
iphlpapi
GetAdaptersInfo
advapi32
CryptDeriveKey
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
FreeSid
LookupAccountNameW
GetUserNameW
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptDestroyKey
CryptDecrypt
CryptGetKeyParam
CryptReleaseContext
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSidSubAuthority
Sections
.text Size: 140KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 860B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ