W:\NMC\Alt\WZRel90\WinZip\WZQKPICK\wzqkpick.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fd33ed0515a1fe25c8a20f4c36c837bf_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd33ed0515a1fe25c8a20f4c36c837bf_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fd33ed0515a1fe25c8a20f4c36c837bf_JaffaCakes118
-
Size
116KB
-
MD5
fd33ed0515a1fe25c8a20f4c36c837bf
-
SHA1
c852a1e4b0b01337175024b4ca1614fe5e2008b7
-
SHA256
2ca8ef7157b8eea2529b8aa3df9b49541d099e0d16bb00f55af9fb3b33978a86
-
SHA512
0616b4f3b77ddece5dddf1b46220888852a1eda40e7bd914f4e54341627630348e596b9b851268dc52aa00996e2bb820ce43468c77c37d9ad63486f44cac65bc
-
SSDEEP
3072:OhnDxBFlZadd4tYnRZi0deedcCcr21L+um:OND/nZav4tYn+OeeWhe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd33ed0515a1fe25c8a20f4c36c837bf_JaffaCakes118
Files
-
fd33ed0515a1fe25c8a20f4c36c837bf_JaffaCakes118.exe windows:4 windows x86 arch:x86
850b403fb0833f60e122ea30725e0002
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
lstrcmpiA
GlobalFindAtomA
WinExec
GlobalDeleteAtom
GlobalAddAtomA
GetTempPathA
GetShortPathNameA
lstrcpynA
lstrcatA
lstrcpyA
IsDBCSLeadByte
lstrlenA
FindFirstFileA
FindClose
GetTickCount
GetVersionExA
FlushFileBuffers
SetStdHandle
SetFilePointer
SetConsoleCtrlHandler
HeapReAlloc
HeapAlloc
LCMapStringW
LCMapStringA
GetLocaleInfoA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapValidate
IsBadReadPtr
IsBadWritePtr
GetStringTypeW
GetStringTypeA
InterlockedIncrement
OutputDebugStringA
InterlockedDecrement
DebugBreak
WriteFile
VirtualFree
HeapFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
CloseHandle
GetOEMCP
GetACP
CompareStringW
GetLastError
CompareStringA
GetCPInfo
MultiByteToWideChar
GetProcAddress
LoadLibraryA
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
RtlUnwind
advapi32
RegOpenKeyA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyA
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey
RegQueryValueA
user32
CreateDialogParamA
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
UnhookWindowsHook
SetDlgItemTextA
GetSystemMetrics
SendMessageA
RegisterWindowMessageA
ShowWindow
DestroyWindow
PostQuitMessage
KillTimer
DialogBoxParamA
SetFocus
GetDoubleClickTime
GetCursorPos
CreatePopupMenu
SetForegroundWindow
TrackPopupMenuEx
PostMessageA
DestroyMenu
CheckRadioButton
GetDlgItem
EnableWindow
EndDialog
IsDlgButtonChecked
SetTimer
LoadImageA
DrawIconEx
DestroyIcon
IsWindow
GetClassNameA
MessageBoxA
LoadStringA
InsertMenuA
CharNextA
wsprintfA
SetWindowsHookA
shell32
Shell_NotifyIconA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
Sections
.text Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE