Static task
static1
Behavioral task
behavioral1
Sample
Schuld.Pdf_________________________________________________________________.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Schuld.Pdf_________________________________________________________________.exe
Resource
win10v2004-20240802-en
General
-
Target
e0ba5378aa37d0bded416a96bb4dc06e_JaffaCakes118
-
Size
137KB
-
MD5
e0ba5378aa37d0bded416a96bb4dc06e
-
SHA1
41cdfc1ab282b915e4ef404c5278fe55970e8d12
-
SHA256
5508f95cb418342d0bf77828d1f0225b9cae09fbf2c869b7cdfdf0b39796e257
-
SHA512
bf909f10fcbca9818fccbcb334000bc2991a3d6cee61db87b06a469b47be95d6c86a9aacf9e76519dc70f071418c38f841aa09c5e166191da90a634fbed40ba0
-
SSDEEP
3072:KjAeGp5ds4jbzCdLtxjHdeqjKw9/X8VcQnxRMjU+nx8AT:u8sabzCnxHjd9/XQcQxmteQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Schuld.Pdf_________________________________________________________________.exe
Files
-
e0ba5378aa37d0bded416a96bb4dc06e_JaffaCakes118.zip
-
Schuld.Pdf_________________________________________________________________.exe.exe windows:1 windows x86 arch:x86
93d9a1867e35413124ab2be1437fd57b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_write
sscanf
__getmainargs
_execve
_strtoui64
_ltow
_ismbclegal
_c_exit
_execlp
_spawnve
_mbsspnp
_ismbslead
_strupr
_sleep
_wfindfirsti64
_snwprintf
_popen
_wspawnvp
__p__fmode
_ftime
_waccess
_ismbcupper
_flsbuf
_putw
_toupper
_getdrives
_mbscoll
exit
_mbscspn
fscanf
iswascii
_daylight
_getche
_time64
strtol
strcpy
strlen
memset
_acmdln
_exit
_adj_fdivr_m64
_ui64toa
iswlower
wcslen
_seh_longjmp_unwind
ctime
_fpclass
_adjust_fdiv
_controlfp
_beginthreadex
_fdopen
malloc
__p__commode
_XcptFilter
calloc
_winmajor
_vsnprintf
_ismbbtrail
strncpy
_spawnle
_except_handler3
_wfindnext64
__set_app_type
_initterm
_resetstkoflw
wcscat
_mbsstr
_ismbbkprint
wcsftime
strftime
_mbbtype
_tzset
_ismbbkana
_strtime
_fileinfo
memcpy
sprintf
_ismbcprint
strtok
_longjmpex
_mbsrchr
__setusermatherr
iscntrl
user32
KillTimer
GetWindowRect
GetWindowDC
IntersectRect
SetScrollInfo
BeginDeferWindowPos
EnableMenuItem
InsertMenuA
InvalidateRect
PostQuitMessage
GetUpdateRgn
RedrawWindow
DrawIconEx
InflateRect
SetDlgItemTextA
LoadImageA
GetDlgItem
GetMenu
CopyRect
SetWindowTextA
LoadIconA
GetDesktopWindow
IsDialogMessageA
SendMessageTimeoutA
CallWindowProcA
TrackPopupMenuEx
CheckDlgButton
LoadStringA
PostMessageA
GetKeyState
GetWindow
DestroyIcon
GetMessageA
GetCursorPos
GetWindowLongA
UnionRect
DefDlgProcA
TranslateAcceleratorA
BeginPaint
GetMenuItemCount
SendMessageA
GetDlgCtrlID
ReleaseDC
CreateIconIndirect
TrackPopupMenu
ShowWindow
IsDlgButtonChecked
ReleaseCapture
MessageBoxA
wsprintfA
UpdateWindow
EnumWindows
EndDialog
IsWindowVisible
PeekMessageA
CheckMenuRadioItem
kernel32
GetDateFormatA
GetStringTypeW
GetStringTypeA
GlobalAlloc
RtlUnwind
GetProcessAffinityMask
GetConsoleCP
GetStartupInfoA
SetEvent
Module32Next
Sleep
UnhandledExceptionFilter
VirtualAlloc
IsBadReadPtr
GlobalUnlock
SearchPathA
GetModuleHandleA
GlobalMemoryStatus
GetProcessWorkingSetSize
lstrcpynA
MapViewOfFile
VirtualFree
TlsGetValue
lstrcpyA
IsValidCodePage
GetNumberFormatA
GetTimeFormatA
CreateEventA
GetConsoleMode
GetOEMCP
EnterCriticalSection
WaitForSingleObject
lstrcatA
GetCurrentDirectoryA
LeaveCriticalSection
lstrlenA
GetCPInfo
LocalFree
FindClose
InterlockedIncrement
GetCurrentThread
CloseHandle
TlsSetValue
HeapReAlloc
FindFirstFileA
GetProcAddress
FormatMessageA
InterlockedExchange
TerminateProcess
GetVersion
HeapAlloc
OpenEventA
LockResource
FreeLibrary
SetLastError
GetCurrentProcess
GetModuleFileNameA
FlushFileBuffers
RaiseException
InterlockedDecrement
LCMapStringW
FindResourceA
Sections
.text Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ