c:\googleclient\picasa39-stable\payloadXML.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6f74f88740f8e2d5d4f08a5018c6332d_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6f74f88740f8e2d5d4f08a5018c6332d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6f74f88740f8e2d5d4f08a5018c6332d_JaffaCakes118
-
Size
315KB
-
MD5
6f74f88740f8e2d5d4f08a5018c6332d
-
SHA1
0b30c6d5160ab761d3afe3d55dab2d1280df5762
-
SHA256
47f09a4a48a357b6825d1d3765dfd0dc520c45457c8110e9eeb09a2accea5d3e
-
SHA512
7fefd8038610f83c79d8cc259ec96a8f0091d04cb78300a089e6d6eadebc3d09401412f27dad892e991c17acc6c17d94fd33d5a64001092c75a09a7abe8c4ab5
-
SSDEEP
6144:uC7qDU+JlXXC7qDU+JlXuQt54Xbm7Y5/UCkt+:uuqY+7uqY+CQM5wo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6f74f88740f8e2d5d4f08a5018c6332d_JaffaCakes118
Files
-
6f74f88740f8e2d5d4f08a5018c6332d_JaffaCakes118.exe windows:4 windows x86 arch:x86
fd84ca43b42f0a9dd16b55725642cae6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathAddBackslashA
urlmon
URLDownloadToFileA
wintrust
WinVerifyTrust
kernel32
RaiseException
lstrcmpW
GetLastError
MultiByteToWideChar
GetProcAddress
LoadLibraryA
GetModuleFileNameA
WriteFile
CreateEventA
MoveFileA
GetCurrentThreadId
GetUserDefaultLangID
CopyFileA
GetExitCodeThread
LockResource
GetModuleHandleA
CloseHandle
GetFileAttributesA
FindResourceExA
SetFileAttributesA
GlobalAlloc
GetExitCodeProcess
CreateMutexA
GlobalFree
GetTempFileNameA
GetTempPathA
ResetEvent
CreateFileA
CreateDirectoryA
OpenMutexA
FindResourceA
WaitForSingleObject
Sleep
DeleteFileA
CreateThread
LoadResource
SizeofResource
SetEvent
FreeLibrary
GetCurrentProcessId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
TerminateProcess
OpenProcess
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
HeapSize
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
InitializeCriticalSection
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
ExitProcess
LCMapStringW
WideCharToMultiByte
LCMapStringA
FlushFileBuffers
lstrlenA
IsValidCodePage
GetOEMCP
GetCPInfo
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapFree
GetSystemTimeAsFileTime
GetCommandLineA
HeapAlloc
GetProcessHeap
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
user32
MessageBoxA
IsWindow
FindWindowA
GetClassNameA
EnumWindows
SetWindowTextA
GetWindowLongA
LoadIconA
LoadStringW
UpdateWindow
KillTimer
DestroyWindow
MsgWaitForMultipleObjects
DispatchMessageA
SetWindowPos
SetWindowLongA
DialogBoxParamA
SetClassLongA
ShowWindow
SetWindowTextW
GetMessageA
IsDialogMessageA
TranslateMessage
GetDlgItem
GetSystemMetrics
EndDialog
CreateDialogParamW
SetTimer
GetWindowRect
SendMessageA
advapi32
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegDeleteValueA
shell32
ShellExecuteA
ShellExecuteExA
ole32
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocStringLen
Sections
.text Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14.1MB - Virtual size: 14.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ