D:\Bot\hook_13\Release\dropper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0c68ac7966ea04b919342af170ddd326_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
0c68ac7966ea04b919342af170ddd326_JaffaCakes118
-
Size
83KB
-
MD5
0c68ac7966ea04b919342af170ddd326
-
SHA1
90437532dd19de23c8a91d99ba41e1eea72cec4e
-
SHA256
a8eb8408f72d01bfdfa7fb939312f6153df7c4ce329b4772733fc48b3de8da0d
-
SHA512
9e3d21661957acd0abe56b4e860e76c3b3ec32377f22b5e0e6f08e83b9c9dd5e96d9d396c0336301c3e763ee8608fff867e4ef81bec9c171be6afd28640e0aff
-
SSDEEP
1536:CQDpHim85Zt0egz78iUim0pdsoFbfui+flMAZaxl2D5UtOCEk:PHON8XpP1uFflM2D/c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c68ac7966ea04b919342af170ddd326_JaffaCakes118
Files
-
0c68ac7966ea04b919342af170ddd326_JaffaCakes118.exe windows:5 windows x86 arch:x86
ac53d537d8f29a2d004e314d7ed1c7ea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateFileW
lstrcatW
lstrcpyW
lstrlenW
CreateProcessW
GetStartupInfoW
SetFileTime
GetFileTime
GetVersionExW
ExpandEnvironmentStringsW
GetShortPathNameW
GetModuleFileNameW
DeleteFileW
ExitProcess
CreateDirectoryW
MoveFileExW
GetCurrentThread
GetTickCount
QueryPerformanceCounter
SetFilePointer
Sleep
GetProcAddress
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
ReadFile
PeekNamedPipe
ResetEvent
WaitForSingleObject
OpenEventA
CreateEventA
SetEvent
SetNamedPipeHandleState
WaitNamedPipeA
CreateFileA
WriteFile
CloseHandle
lstrcatA
FindFirstVolumeA
FindVolumeClose
lstrlenA
GetVersionExA
GetLastError
GetCurrentProcess
user32
SetCursor
wsprintfA
LoadCursorA
advapi32
CryptDestroyHash
OpenProcessToken
GetTokenInformation
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 68KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 902B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ