c:\Documents and Settings\Administrator.MICRO-89F1FD0F9\桌面\Down\NewDownLoader\NewDownLoader\Release\NewDownLoader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
af1f12541d9a88f9c52b088e0f8fd3c0_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
af1f12541d9a88f9c52b088e0f8fd3c0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
af1f12541d9a88f9c52b088e0f8fd3c0_JaffaCakes118
-
Size
72KB
-
MD5
af1f12541d9a88f9c52b088e0f8fd3c0
-
SHA1
2d27444ee13e56944d984775914cd1439a2ff679
-
SHA256
08c3ffe9658f2a773fdeca7f805e9999425117be5cbc52991a364126e4076ca1
-
SHA512
1324e978611f8b5ac61ca36c08d43b208dc01c7a0cb75c6d97f4c0768d4b25fc46a5bac96b6c520ee4f67e7eb0a736adf4e180e10082c43891597dcd44ff2ab5
-
SSDEEP
768:CcZAPXvDlwQJuZa9waT3bMCkSz8vZlJ5rwzfGP5yYgTNITFVkKF80mZVu2tZI:nAPX7lR8cPz268RH5Mzf+y5BITbUltZI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource af1f12541d9a88f9c52b088e0f8fd3c0_JaffaCakes118
Files
-
af1f12541d9a88f9c52b088e0f8fd3c0_JaffaCakes118.exe windows:4 windows x86 arch:x86
d72b0020e1ca3eceee9137a726984435
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WriteFile
SetFilePointer
GetProcAddress
GetCurrentProcessId
OpenProcess
LoadLibraryA
GetSystemTime
Process32FirstW
GetTempPathW
FreeLibrary
LoadLibraryW
Sleep
Process32NextW
CreateFileA
HeapSize
CloseHandle
CreateToolhelp32Snapshot
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLastError
HeapFree
HeapAlloc
WideCharToMultiByte
GetCommandLineA
GetVersionExA
GetProcessHeap
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSection
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
user32
wsprintfW
DispatchMessageW
GetMessageW
TranslateMessage
winmm
timeGetTime
psapi
GetModuleFileNameExW
shlwapi
PathFindFileNameW
wininet
InternetCloseHandle
InternetReadFile
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 860B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ