c:\Documents and Settings\Абсент\Рабочий стол\Sources\MessageBox_builder(source)\release\QIS Builder by ICQ Hools.pdb
Static task
static1
Behavioral task
behavioral1
Sample
eb7b0814578687d117cde3ec32b50c35_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eb7b0814578687d117cde3ec32b50c35_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eb7b0814578687d117cde3ec32b50c35_JaffaCakes118
-
Size
192KB
-
MD5
eb7b0814578687d117cde3ec32b50c35
-
SHA1
e166993396da69a3e35d681de626f58a18aa62ec
-
SHA256
064dddf9d3c08ca6e949eca28008c2c819cc28c17143f979527dbb9caf7cd281
-
SHA512
341f92a337b24c5a3a82480fdf2b49aa5a20bfabd3a7e9f32b3eaf538b3526f590972a2ee059f9a55942a6e352a7e8a1e50281b6f57e469ddfa16c43f983b26d
-
SSDEEP
3072:232OdItkB1NM42sMzrXj4QOcn4oiM/6AU:JOdLBX92sM/0QOcnGl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb7b0814578687d117cde3ec32b50c35_JaffaCakes118
Files
-
eb7b0814578687d117cde3ec32b50c35_JaffaCakes118.exe windows:4 windows x86 arch:x86
a8cc61a8420c60336e7db1fade0deaa1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mfc80
ord3719
ord3718
ord2533
ord2646
ord2540
ord2838
ord2714
ord1903
ord5203
ord4185
ord6275
ord5073
ord354
ord1908
ord501
ord5152
ord709
ord4244
ord1401
ord3946
ord3641
ord1617
ord1620
ord5912
ord3182
ord6724
ord4262
ord4486
ord1551
ord2862
ord1670
ord1063
ord5200
ord1671
ord1599
ord4890
ord1655
ord4735
ord1656
ord4212
ord1964
ord5182
ord1084
ord5175
ord1362
ord4967
ord3709
ord6277
ord3802
ord6279
ord4749
ord1522
ord2662
ord2172
ord2178
ord4580
ord2405
ord1123
ord2387
ord2385
ord2371
ord2403
ord2415
ord2392
ord2408
ord2413
ord2396
ord2398
ord2400
ord2394
ord2410
ord310
ord2390
ord934
ord930
ord932
ord928
ord923
ord578
ord4035
ord5233
ord5235
ord5960
ord1600
ord4282
ord4722
ord3403
ord2644
ord3949
ord4481
ord4261
ord3333
ord4038
ord4014
ord605
ord6278
ord2020
ord3801
ord6276
ord5975
ord4326
ord1054
ord2063
ord3830
ord2018
ord5583
ord3806
ord1010
ord5102
ord6219
ord5382
ord3832
ord1920
ord2931
ord5224
ord757
ord5226
ord566
ord2248
ord3948
ord4568
ord5230
ord5213
ord3683
ord5566
ord2537
ord4541
ord2731
ord2835
ord4307
ord3345
ord764
ord1207
msvcr80
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
__CxxFrameHandler3
_setmbcp
_controlfp_s
kernel32
LoadResource
SizeofResource
FindResourceA
GetModuleHandleA
lstrlenA
FreeLibrary
CloseHandle
SetFilePointer
InterlockedExchange
LockResource
Sleep
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
CreateFileA
user32
GetSystemMenu
DrawIcon
EnableWindow
LoadIconA
GetClientRect
GetSystemMetrics
SendMessageA
IsIconic
AppendMenuA
comctl32
InitCommonControlsEx
Sections
.text Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ