c:\autobuild\mike\malwareremovalbot\trunk_ns\release\MalwareRemovalBot.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b0f93468f89a05725e96c85d62b74107_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b0f93468f89a05725e96c85d62b74107_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b0f93468f89a05725e96c85d62b74107_JaffaCakes118
-
Size
18.9MB
-
MD5
b0f93468f89a05725e96c85d62b74107
-
SHA1
51acc4623a07a5d24be34eb268ee772fcca412d8
-
SHA256
b88e9ed9decc935ec495187a33f62ce5ca821492e29adbf65f362b7aec0f5545
-
SHA512
4a6ec1bdacfd6ac4a709732661be9baada751338742810ea6a1eaa8815468db56d48c89f487f630308a1d2a9f4d325ca7f7a57a36390b4cc9f0a3ec9687bf452
-
SSDEEP
49152:UdNwk1KN3V8+slxYSLjZMvxR8QTFqDOjGspL8ZmVQ5HmYGQBdy/6Bm35W:i6UGVKLVg5pgZmu5SQBd4Ym35W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b0f93468f89a05725e96c85d62b74107_JaffaCakes118
Files
-
b0f93468f89a05725e96c85d62b74107_JaffaCakes118.exe windows:4 windows x86 arch:x86
43a92edb5a3919d71dcf45c63c4d1326
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
rpcrt4
RpcStringFreeA
UuidCreate
UuidToStringA
kernel32
ReadFile
GetOverlappedResult
SleepEx
lstrcmpA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThreadId
GetCurrentThread
GlobalDeleteAtom
GetModuleFileNameW
SetThreadPriority
SuspendThread
GlobalAddAtomA
GetCurrentProcessId
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
GetThreadLocale
SetFilePointer
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationA
GetFullPathNameA
GetPrivateProfileIntA
GetPrivateProfileStringA
InterlockedIncrement
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetCurrentDirectoryA
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
GetTickCount
WriteFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ConnectNamedPipe
HeapReAlloc
VirtualProtect
VirtualQuery
GetCommandLineA
GetStartupInfoA
ExitThread
CreateThread
SetStdHandle
GetFileType
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
SetEnvironmentVariableA
ExitProcess
RaiseException
HeapSize
GetACP
IsValidCodePage
HeapDestroy
HeapCreate
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
QueryDosDeviceA
GetStringTypeA
GetStringTypeW
GetDriveTypeA
GetLocaleInfoW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
VirtualFree
VirtualAlloc
DisconnectNamedPipe
FlushFileBuffers
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
SetCurrentDirectoryA
GetFileSize
LocalAlloc
TerminateThread
CreateFileA
GetSystemTime
SystemTimeToFileTime
InterlockedDecrement
WinExec
lstrcpynA
FileTimeToLocalFileTime
GetSystemDirectoryA
FindFirstFileA
FindNextFileA
FindClose
GetTempPathA
WritePrivateProfileStringA
HeapFree
GetProcessHeap
HeapAlloc
FreeLibrary
LoadLibraryA
GetSystemInfo
FormatMessageA
FileTimeToSystemTime
GetFileTime
TerminateProcess
ExpandEnvironmentStringsA
MoveFileA
DeleteFileA
LocalFree
CopyFileA
SetFileAttributesA
GetFileAttributesA
CreateNamedPipeA
GetCurrentProcess
Process32Next
OpenProcess
Process32First
CreateToolhelp32Snapshot
SetLastError
GetVersionExA
DeleteCriticalSection
FreeConsole
CreateDirectoryA
GetLocalTime
Sleep
InitializeCriticalSection
GetModuleFileNameA
lstrcpyA
LeaveCriticalSection
SetConsoleScreenBufferSize
EnterCriticalSection
GetStdHandle
GetConsoleScreenBufferInfo
AllocConsole
MulDiv
GlobalUnlock
ResetEvent
GlobalLock
SetEvent
WaitForSingleObject
CloseHandle
GetWindowsDirectoryA
CreateEventA
GlobalAlloc
ResumeThread
GlobalFree
GetProcAddress
FreeResource
GetModuleHandleA
GetEnvironmentVariableA
lstrlenA
CompareStringW
CompareStringA
GetVersion
GetLastError
MultiByteToWideChar
InterlockedExchange
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
CreateFileW
CreateProcessA
SearchPathA
GetLogicalDriveStringsA
lstrcatA
GetLogicalDrives
CreateIoCompletionPort
MoveFileExA
RtlUnwind
Module32Next
Module32First
GetBinaryTypeA
gdi32
GetRgnBox
GetTextColor
GetBkColor
DPtoLP
GetMapMode
GetTextExtentPoint32A
CreateRectRgnIndirect
CreatePen
ExtSelectClipRgn
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
MoveToEx
LineTo
GetClipBox
SetMapMode
RestoreDC
SaveDC
GetDIBits
CreateFontA
SetTextColor
SetBkColor
SetBkMode
CreateFontIndirectA
SelectClipRgn
ExtTextOutA
GetTextMetricsA
GetDeviceCaps
DeleteDC
SelectObject
Rectangle
GetStockObject
CreatePatternBrush
CreateCompatibleBitmap
BitBlt
StretchBlt
CombineRgn
CreateCompatibleDC
CreateBitmap
ExtCreateRegion
CreateRectRgn
CreateSolidBrush
GetPixel
DeleteObject
GetObjectA
GetCurrentObject
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
comctl32
ord17
_TrackMouseEvent
oledlg
ord8
wininet
HttpQueryInfoA
InternetCloseHandle
InternetGetLastResponseInfoA
InternetOpenA
InternetSetStatusCallback
InternetSetFilePointer
InternetWriteFile
InternetReadFile
InternetConnectA
InternetOpenUrlA
HttpOpenRequestA
HttpSendRequestA
InternetQueryDataAvailable
InternetSetOptionExA
InternetQueryOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
msimg32
GradientFill
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 336KB - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17.4MB - Virtual size: 17.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ