f:\Programmieren\old\Absinth_Crypter_stub_6kb\Release\Absinth_Crypter_stub.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b86e720fe7406a365aa5b2f23d8a6da3_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
b86e720fe7406a365aa5b2f23d8a6da3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b86e720fe7406a365aa5b2f23d8a6da3_JaffaCakes118
-
Size
417KB
-
MD5
b86e720fe7406a365aa5b2f23d8a6da3
-
SHA1
701be30c11a2f042cfed8749434877b5e43bcfcd
-
SHA256
a864d3f66e95ac043750bbfb1cd171c8eef68359ae10a341e5ea8bc04c66f079
-
SHA512
62f2dd04fe2088ca5e2f16199647812c03cce0efeedc5d95f09cb21526b8f93c38a7ca1404bebf7af91dc518a6b20cf36d176286f971a483662e0ab1345f7198
-
SSDEEP
384:DplRYeRxX7zyw4uMpZT4EMquHt/boTxJX2cl761LUmKGYCoC6h4BplCTfnHow:lrRt7zyfu6squB8X2M7aLUM56WyT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b86e720fe7406a365aa5b2f23d8a6da3_JaffaCakes118
Files
-
b86e720fe7406a365aa5b2f23d8a6da3_JaffaCakes118.exe windows:4 windows x86 arch:x86
593a879d7c7a9055196d46fd66a88fbb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcr71
_onexit
_amsg_exit
__dllonexit
__security_error_handler
_except_handler3
malloc
fopen
__set_app_type
__p__fmode
__p__commode
_controlfp
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_cexit
_XcptFilter
_exit
_c_exit
wcslen
wcscat
_adjust_fdiv
fclose
fread
fseek
_callnewh
kernel32
GetCurrentThreadId
GetModuleFileNameA
CreateFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CloseHandle
CreateProcessA
GetThreadContext
ReadProcessMemory
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
SetThreadContext
ResumeThread
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
ExitProcess
OutputDebugStringA
GetProcAddress
GetModuleHandleA
mscoree
_CorExeMain
msvcp71
?_Nomemory@std@@YAXXZ
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ