d:\programming\work\arhexe\Release\mp3extractor.pdb
Static task
static1
Behavioral task
behavioral1
Sample
winrar-x64-401ru.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
winrar-x64-401ru.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
wrar401ru.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
wrar401ru.exe
Resource
win10v2004-20240802-en
General
-
Target
97242a24763d2bbd5d74148f42f1d41d_JaffaCakes118
-
Size
3.6MB
-
MD5
97242a24763d2bbd5d74148f42f1d41d
-
SHA1
4be7270ed760357e5d1fbd962e28d7c47847a79f
-
SHA256
a3f923c78d7ee0ef19f7899b6ac62ea5d5d9cf57d842f8fe947982c5f08b635e
-
SHA512
6f9ac6300c01d64e751474f945917cd6b1c6db528912b4da554a92d3d4bac8ec398299890a2906a580c2502edca824f840d8776909245593376bbffa185c183e
-
SSDEEP
98304:RQck7BO76YDFDdkkE6xtOkRPNgbd/KCRwPwF:RuehDFZkkE6xEKgbdSC6Py
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/winrar-x64-401ru.exe unpack001/wrar401ru.exe
Files
-
97242a24763d2bbd5d74148f42f1d41d_JaffaCakes118.zip
-
RarReg.key
-
Readme.txt
-
__MACOSX/._Readme.txt
-
winrar-x64-401ru.exe.exe windows:4 windows x86 arch:x86
c5749505c7087ba8b134749647dc0f7a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FindResourceW
LoadResource
CreateProcessW
GetModuleHandleW
WriteFile
GetSystemDirectoryW
SizeofResource
CreateFileW
GetTempPathW
LockResource
CloseHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
GetLastError
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
LoadLibraryA
InitializeCriticalSection
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
Sections
.text Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
wrar401ru.exe.exe windows:4 windows x86 arch:x86
c5749505c7087ba8b134749647dc0f7a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
d:\programming\work\arhexe\Release\mp3extractor.pdb
Imports
kernel32
FindResourceW
LoadResource
CreateProcessW
GetModuleHandleW
WriteFile
GetSystemDirectoryW
SizeofResource
CreateFileW
GetTempPathW
LockResource
CloseHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
GetLastError
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
LoadLibraryA
InitializeCriticalSection
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
Sections
.text Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ