c:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Eigene Downloads\Churrasco\Debug\Churrasco.pdb
Static task
static1
Behavioral task
behavioral1
Sample
04a5477f7de39330b7c3b2cc5d608000_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
04a5477f7de39330b7c3b2cc5d608000_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
04a5477f7de39330b7c3b2cc5d608000_JaffaCakes118
-
Size
440KB
-
MD5
04a5477f7de39330b7c3b2cc5d608000
-
SHA1
04f91faa87849a78eaa9339c4c89ce4d645d759f
-
SHA256
dd476728ecae3edae3df597042cebc3fb5dbc9e03228fdd9fe6ea738f06ce429
-
SHA512
036f6f4cefd8c372f005f0c92fa77ba47b53c9947df53a03ef9653e5f58e752bab19a17a1c2b34125dd3390f0d7ef4eea7ca64db22d7e59c277a7e79c7f32774
-
SSDEEP
6144:fmWjltGZEw9tsGM9Jpk0zsZ1EVg1i3ckT5E5DdRGq+W6HQt6i0PAlXZ:fmWonfpM97krXH1i3ckT5E5hR9F5si0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04a5477f7de39330b7c3b2cc5d608000_JaffaCakes118
Files
-
04a5477f7de39330b7c3b2cc5d608000_JaffaCakes118.exe windows:5 windows x86 arch:x86
628d228d25f88d80d9800db130c6972c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
xolehlp
DtcGetTransactionManagerExA
kernel32
DuplicateHandle
GetCurrentProcess
OpenProcess
GetProcessHeap
QueueUserAPC
GetProcessIdOfThread
OpenThread
HeapFree
GetCurrentThread
GetEnvironmentVariableA
CloseHandle
LoadLibraryA
GetProcAddress
CompareStringW
Sleep
GetLastError
RaiseException
GetCommandLineA
HeapValidate
IsBadReadPtr
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
DebugBreak
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
DeleteCriticalSection
FatalAppExitA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapDestroy
HeapCreate
VirtualFree
WriteFile
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
SetConsoleCtrlHandler
LoadLibraryW
RtlUnwind
VirtualQuery
FreeLibrary
InitializeCriticalSectionAndSpinCount
InterlockedExchange
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointer
GetLocaleInfoW
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
CompareStringA
advapi32
ImpersonateSelf
LookupAccountSidA
SetThreadToken
OpenThreadToken
DuplicateTokenEx
CreateProcessAsUserA
GetTokenInformation
GetUserNameA
Sections
.textbss Size: - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 356KB - Virtual size: 356KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ