D:\Programiranje\Bravo Studio\SVN\_playsushi\_trunk\bin\uninstaller.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fc22f13062b46ab5bfea4c7bab140d57_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fc22f13062b46ab5bfea4c7bab140d57_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fc22f13062b46ab5bfea4c7bab140d57_JaffaCakes118
-
Size
184KB
-
MD5
fc22f13062b46ab5bfea4c7bab140d57
-
SHA1
74733471a702c77accbf40454645a95b5013cbe6
-
SHA256
3d9660d82ecfb4d1884e39f7bfe7c3dad2297e49d555ac1721da1d3c54079f86
-
SHA512
fb9f79cb250ffbd6e1679f49c762523444571a2f08df2d3ba2113f4ecaad5d536c69735b65d1df504b218de8f21c3d77ce97bda47fd85f4292b62631a01f2e2a
-
SSDEEP
3072:7asIFQ1ShNlfukGuvZ5fJ0BMCQUP0AqG5X566DHA3xQ+VH/B:76xTMh0AqI5VAyYH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fc22f13062b46ab5bfea4c7bab140d57_JaffaCakes118
Files
-
fc22f13062b46ab5bfea4c7bab140d57_JaffaCakes118.exe windows:5 windows x86 arch:x86
9d0e769a308fab6506a15f0fe757f9f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathFileExistsA
wnsprintfA
StrNCatA
StrStrIA
kernel32
MoveFileExA
FreeLibrary
Process32First
WriteFile
Sleep
CreateProcessA
ReadFile
FindFirstFileA
lstrcmpiA
RemoveDirectoryA
FindClose
LoadLibraryA
Process32Next
GetModuleFileNameA
FindNextFileA
CreateToolhelp32Snapshot
DeleteFileA
WriteConsoleA
GetStringTypeW
GetFileSize
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapSize
FlushFileBuffers
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
MultiByteToWideChar
SetEndOfFile
SetFilePointer
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
CreateFileA
ExitProcess
LocalFree
GetLastError
OpenProcess
ExpandEnvironmentStringsA
HeapFree
HeapAlloc
lstrcmpA
GetCurrentProcessId
GetTickCount
lstrlenA
GetVolumeInformationA
GetProcessHeap
GetComputerNameA
GetTempPathA
CloseHandle
GetVersionExA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetCurrentProcess
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStdHandle
SetHandleCount
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
GetFileType
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
user32
RegisterClassExA
PostQuitMessage
SendDlgItemMessageA
FillRect
LoadBitmapA
LoadIconA
ExitWindowsEx
BeginPaint
IsDialogMessageA
TranslateMessage
MapVirtualKeyA
GetWindowLongA
GetWindowRect
GetDlgItem
DefWindowProcA
SetWindowPos
ShowWindow
DispatchMessageA
AdjustWindowRectEx
SetWindowTextA
UpdateWindow
LoadCursorA
GetUserObjectSecurity
GetWindowThreadProcessId
GetShellWindow
SendMessageA
MessageBoxA
GetMessageA
keybd_event
DestroyWindow
EndPaint
CreateWindowExA
gdi32
BitBlt
DeleteDC
CreateFontA
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
GetObjectA
GetStockObject
CreateSolidBrush
TextOutA
GetTextExtentPoint32A
advapi32
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
AdjustTokenPrivileges
CheckTokenMembership
FreeSid
IsValidSid
GetSecurityDescriptorOwner
AllocateAndInitializeSid
LookupPrivilegeValueA
ConvertSidToStringSidA
OpenProcessToken
RegCreateKeyA
RegCloseKey
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
shell32
SHFileOperationA
ShellExecuteA
SHGetFolderPathA
Sections
.text Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ