e:\p2p服务器\p2p地图下载\p2p_client_1.0\vsupdater\bin\vsupdater.pdb
Static task
static1
Behavioral task
behavioral1
Sample
44e76f8671c110b3e23476328885f66f_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
44e76f8671c110b3e23476328885f66f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
44e76f8671c110b3e23476328885f66f_JaffaCakes118
-
Size
444KB
-
MD5
44e76f8671c110b3e23476328885f66f
-
SHA1
3a4fba941b962fe1749f7470c08bcb2d4e4934d3
-
SHA256
b6a0a6a5b2b36e51ae22473d92bcf78cc93a4ccf79a2c9b2e328efc8a7d34976
-
SHA512
cbb516ebb84477e2f711da1770dbe6957381a8783f1a0f187e6230276494e5c95e8779e7484f507c34911ae515c4f1e610e8d18ec8209aec43679588b1e2fafb
-
SSDEEP
12288:XDtCaa+eowXJg1XAuANKsA6IHmHBpuO2JVUii1:ZcowXJ1uANKsA6IHWaO2JVzK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44e76f8671c110b3e23476328885f66f_JaffaCakes118
Files
-
44e76f8671c110b3e23476328885f66f_JaffaCakes118.exe windows:4 windows x86 arch:x86
546ad454cbf16de9945eddc064b5b66a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathRemoveFileSpecA
PathIsDirectoryA
ws2_32
htonl
ntohl
socket
setsockopt
gethostname
bind
getsockname
ioctlsocket
WSAIoctl
select
recvfrom
ntohs
inet_ntoa
sendto
closesocket
WSACleanup
WSAStartup
WSAGetLastError
inet_addr
htons
gethostbyname
wininet
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
HttpQueryInfoA
InternetReadFileExA
InternetCloseHandle
InternetSetStatusCallback
comctl32
ord17
kernel32
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetSystemInfo
VirtualAlloc
VirtualProtect
GetUserDefaultLCID
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
GetLastError
ReadFile
WriteFile
SetNamedPipeHandleState
CreateFileA
CreateEventA
UnmapViewOfFile
SetEvent
WaitForSingleObject
MapViewOfFile
CreateFileMappingA
SetEndOfFile
SetFilePointer
Sleep
GetTickCount
ReleaseMutex
CreateMutexA
CreateProcessA
DeleteFileA
GetModuleHandleA
GetModuleFileNameA
InterlockedExchangeAdd
InterlockedCompareExchange
QueryPerformanceFrequency
EnumSystemLocalesA
CreateNamedPipeA
ConnectNamedPipe
CreateDirectoryA
FindClose
FindNextFileA
MoveFileExA
FindFirstFileA
CopyFileA
GetFileSize
OpenMutexA
CopyFileExA
GetCommandLineA
SetUnhandledExceptionFilter
GetTimeZoneInformation
HeapSize
HeapReAlloc
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
VirtualQuery
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
GetProcAddress
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetCPInfo
HeapAlloc
GetVersionExA
GetStartupInfoA
ResumeThread
HeapFree
GetCurrentProcessId
IsValidLocale
GetSystemTimeAsFileTime
GetDateFormatA
GetTimeFormatA
CreateThread
GetCurrentThreadId
ExitThread
ExitProcess
RaiseException
RtlUnwind
InitializeCriticalSection
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
IsValidCodePage
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
LoadLibraryA
SetStdHandle
GetLocaleInfoW
CompareStringA
CompareStringW
QueryPerformanceCounter
SetEnvironmentVariableA
user32
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
DestroyIcon
CreateDialogParamA
LoadImageA
DestroyWindow
PostQuitMessage
GetWindowRect
PtInRect
GetSysColor
IsWindowVisible
LoadCursorA
GetWindowTextA
EnableWindow
GetWindowLongA
SetWindowLongA
SendDlgItemMessageA
SetTimer
BeginPaint
LoadBitmapA
EndPaint
SetRect
DrawTextA
SetDlgItemTextA
SetWindowTextA
GetDlgItem
SetWindowPos
InvalidateRect
UpdateWindow
GetCursorPos
CreatePopupMenu
InsertMenuA
SetForegroundWindow
TrackPopupMenu
DestroyMenu
ShowWindow
SendMessageA
SetCursor
gdi32
CreateSolidBrush
PatBlt
CreateCompatibleDC
GetObjectA
BitBlt
DeleteObject
CreateFontA
SetBkMode
SetBkColor
SetTextColor
CreateFontIndirectA
GetCurrentObject
SelectObject
DeleteDC
GetStockObject
shell32
ShellExecuteA
Shell_NotifyIconA
Sections
.text Size: 208KB - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 184KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ