___CPPdebugHook
_decrypt
_encrypt
Static task
static1
Behavioral task
behavioral1
Sample
Data/dll/decrypt.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Data/dll/decrypt.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Pesyou PES 2013 BAL Editor v1.3.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Pesyou PES 2013 BAL Editor v1.3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win10v2004-20241007-en
Target
26969322e06550c1c4694749addfb9dc_JaffaCakes118
Size
132KB
MD5
26969322e06550c1c4694749addfb9dc
SHA1
ecd26f45ab18fabcaead42fd21212b95a0dd83c1
SHA256
5aef3cb7be699b66fa891c953580e14cd906a59c10743b6fe890784b9d6dcde7
SHA512
cd80d9dcc5d1451b75489f1eabcf10128f87b86a371a854ee37778a8ba19feb916b6497496ecf596cedea58ce0d73ac4a7cb39ca1e25521f2d3a94a84a995f90
SSDEEP
3072:7WzS80+2lFFg+QSupPbDMl74yBjP1HoodaavHPK2l4W1I05tua/:IS80R5g+l4EzNoyNvK2lP1Vu+
Checks for missing Authenticode signature.
resource |
---|
unpack001/Data/dll/decrypt.dll |
unpack001/Pesyou PES 2013 BAL Editor v1.3.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CloseHandle
CreateFileA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCurrentThreadId
GetEnvironmentStrings
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetVersion
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
RaiseException
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WriteFile
EnumThreadWindows
MessageBoxA
wsprintfA
___CPPdebugHook
_decrypt
_encrypt
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
C:\Users\omar ahmed\Documents\Visual Studio 2012\Projects\pesyouBALManager-2\pesyouBALManager\obj\Debug\pesyouBALManager.pdb
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ