C:\GitLab-Runner\builds\FU6P4GEj\0\pro-inf\csgo_internal\build\loader\x86\Release\loader.pdb
Behavioral task
behavioral1
Sample
c20309433304730e17264a13876fc469_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c20309433304730e17264a13876fc469_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c20309433304730e17264a13876fc469_JaffaCakes118
-
Size
10.8MB
-
MD5
c20309433304730e17264a13876fc469
-
SHA1
078d11a5ccce778fd232d199a0574cfa6d8124b3
-
SHA256
64905ee29af81552087366ffeffdec1ea6c299c72d338c530560fef10ace6678
-
SHA512
99f85ce5643401f8e8a30e4ce2fc5c904a801408905d48c0f7980267c53ebabb111c3257ba6563bd61713d2746ca6b491d6359d1424122fae949d626817b9c24
-
SSDEEP
196608:G0d1Fj1l60WG2Ut8aeOE5sYQzcYsrC8pbJ0KWzE1bd2It6TP:G0dT94Uaz5sYQzcYkCqOKD1UItQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c20309433304730e17264a13876fc469_JaffaCakes118
Files
-
c20309433304730e17264a13876fc469_JaffaCakes118.exe windows:6 windows x86 arch:x86
cbaf7cb8a8b6056599553110c6064a40
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
d3d9
Direct3DCreate9
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
shell32
SHGetSpecialFolderPathA
ole32
OleInitialize
shlwapi
PathGetDriveNumberA
dwmapi
DwmExtendFrameIntoClientArea
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
ws2_32
WSASetLastError
advapi32
CryptDestroyHash
oleaut32
SysFreeString
ntdll
RtlGetVersion
crypt32
CertCloseStore
wtsapi32
WTSSendMessageW
Exports
Exports
�����J���-���̿g��a���=��+|�"�,���R��j�[�����n-vr�3!=�6ı�?���(���=�m�EW)��ӆM=7e`�:��U� ]u��k,�{���L��&h�a�f%\B�W����UF�� �y�xX�g���V��h������M�Z˪>:U,L@|�&I�⮂ K�<N�>0s�a��6(#��J&�X�[ҏ�f�g6��o�H ��\Oʅ�t<~"��S-�3A��}N8���,��Ή�5��Y�vU$ 뫚�]�P!������������a*Rb3.\�Y����|C��LmE���������Gbī�������=�cĐ�x���� Ju���(��Y�v��7Cr����=q�,HN��i��8�������3��*�0cE���j^� !u�S6�m���/����V��p�_�Y){�����z�r S�g p�$�&.}����r$vr����������_�� �h�g �c�q$����n �4��Rj�u>������*ƙ���+V�\ʃC�o�e �*D�� ܤ����גk�"�ڭ�b=����%'4$�L5¯+��K��_�ָ_v��9�C�V�����~����6�ͭ�gx���_�@�J�.2��vAw��O��x�*��8� �$?�t�T�.�e3���!@̌�4�$+�P��q��X~��0���������B���q�g\#.MN~����ý��MKQ������e��L��q:ˇ��w�T?��$����b ��g���+�4HQ^�/8��8r;N/��;��P��W���&���,���8�1�ɏ���铄'�Y����L�(��� �$�� |����$�M����UZ�È�\�'Ǜlu{y���I<a�l����A!pL�2�v�vpJV͎���0H+�BVzUk�cΎ^�h�{J2U��#��VQ�\�)��y� ���w�H拝�r �o���&%Wu;�d־:��)��b����4�-�R�t��9��%K.��@#�^K����!TKƩ�<܀�w�j���4�=�?zZ��5S�'��<fo3�}N�B�6��9��;�����t��p<�_�����[�����&,Em��w^`�ƅ9���zG潊�b0��ء�p쇻������;��k����.��U�R(3µ&2�f�H�J��] ���N��=��+��6x��W��!eΎ7&�@Y�4���}�'!?g���%�c�lU�;���;Ri�� �ϡu�p� =q�=���qij��ޓG<�B�����'�,R#4/�v}�{�T�j����?���x��x$��(��\��E�_�{M5A�f��.s�5�ٮѥZ΄�RD�^)��H �6Ƨl���� �⟸9�'����)R���J7�ad�fN�-�+gȵ{�o��ɶF�~~L�_�җ�eq�ئ�]U&�9�Y�P�7j��Ϲ�Ƀ����{�(���u+�zxO.�D�s�y}��ʉ���0 �D�]g��ֳߔ�ɂ�0�R� M���@A�'@qۂ����t4J��֤�ۑ��T�T�[b���p ��.|� P�^�;�۞�a�`�`a(k�2��e��I)��6������ɦ���B)-�~�t/��>(m�wP�k��#w�Mq<Ӏ^ ��{V� �� r�E�-j#4`*PL��,Ĩi�'i��;�U!�1X��0�߅u�ӵ�srø�Ӥ����S;@&k��M/C9g�U�Tը���z|&��?�L^�Z/Ƞ�<M��:h�������L�ܭT3vQ�I.�Ͱ���29I��r�G��ٕ[�� �?��R����-J�Է�xl;���Fi����� �a�@�EZ���.� Nd���7�z������1�+����&fڳOv�C'K�{�_�Ƿ3����j~1�u�FnDG�����I[��v�y���>^Q��s�ľ��k"����SU�C��/�\Ѳ�P�7�!�L1�.�/. ��1���:q��qp�sM�ߴ�w)�+�W����k��+��ܡ_D5�Ѿ����Y�m��� t�G���+�j���y�98�i�nj���.��+��e��t�c���,u��J�!�#jC�Z�M�D$~�"�W������]�/��C(���>WvL&`�"�ۤ=|I�76���T9�k̾Ya�a"t-G�-K�'&>&�ٵ����ج�{~��sR� 7e��J<���P�J�SB"Lph7B��[��p����?Ya*��4�{v�����ݥ�n�HH��>)4*8����j��v)���ԜE��=��x��O�Zu��\(`� �7Q�Y�< �Y��h����TB���j��DM ��ܖu����j���� MXޥ����N���jg�vo��>��U�1�1��� ��l[�>$`��t�����8)��t�?�G�ZF?�^B��Z���p�#�{��u�s�?i?��dkݛ�Cw�t_�Uӷ@P�`�6���!FҚ�½���L{���r�wP��!S��X�"]X�W�����媈��܂�*���I<�����6��k�Ȱg�P�t���G�Д�c6�.��z2����%i�A�oH�z�-�p�,Ώ�̚��3M:0"�w/�d����EJ���:pWl�+ F���; l1S��lR�mP�i�Q���D"4&�*4�$��t����p�o�����!>B'K:&��0zꅥ U��|��O��b��v7�-�-���6eU`�: f�ZHc���ڕ<,�q�?�'d�C���Da^�c��f��"����Ӧ�J��}�+���W ;m����[�"V��.eʛ8��Q�sI��Y+���@�kI�0�����!S�J� v.�=AV3�Q�o�^H�;KSP(�g�kaA*^����`G����7 D������?�F��T2�JA{s�������j����`AV+���4�u����?�Y?�3]`pU��q� +"�)�7�%?b������뎈�.8:;�x�AR����Q� ?+f¦�Z�Z�d��[n�j܃�KBM"� ۙ#��hP�t���ǡ�ϬH?"v���� �D"�Ɲ����E>z�TR����
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 412KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.8MB - Virtual size: 10.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ