J:\Projects\c#\PES UE 2013\PESUE13\bin\Release\United\PESUE13.pdb
Static task
static1
Behavioral task
behavioral1
Sample
PES2013D1_Ultimate.editor.v5.3.5/PESUE13.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PES2013D1_Ultimate.editor.v5.3.5/PESUE13.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
PES2013D1_Ultimate.editor.v5.3.5/zlib1.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
PES2013D1_Ultimate.editor.v5.3.5/zlib1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
PES2013D1_Ultimate.editor.v5.3.5/说明介绍.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
PES2013D1_Ultimate.editor.v5.3.5/说明介绍.url
Resource
win10v2004-20241007-en
General
-
Target
547645ce26a33fa6c45e704fe3a82fd4_JaffaCakes118
-
Size
864KB
-
MD5
547645ce26a33fa6c45e704fe3a82fd4
-
SHA1
05ccb7a6e86d41422aec4e23bb372374160cfc75
-
SHA256
e5f9000726efd5400581179cc29589583fe5b073a07fc620ebb04c0f570a850d
-
SHA512
925588010f2ffe7e71d0d7d359f8d140a5943578e6fe0454d7230ce48a5cfb2c0cb77b5c0e43f5a1b2e914ad1dec38d631e6190f0044c8636a8a390f592e1203
-
SSDEEP
12288:Y4Fve4Y9qmwZ/aQimPFWf7bgPQ/sY27K5u0CSySisSb/42e22HmUIDdQ0uNn:Y4Fm4aGiE8F/sYMi9CSVTM2GUU0n
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/PES2013D1_Ultimate.editor.v5.3.5/PESUE13.exe unpack001/PES2013D1_Ultimate.editor.v5.3.5/zlib1.dll
Files
-
547645ce26a33fa6c45e704fe3a82fd4_JaffaCakes118.rar
-
PES2013D1_Ultimate.editor.v5.3.5/Leagues.xml
-
PES2013D1_Ultimate.editor.v5.3.5/PESUE13.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 938KB - Virtual size: 938KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
PES2013D1_Ultimate.editor.v5.3.5/Settings.ini
-
PES2013D1_Ultimate.editor.v5.3.5/zlib1.dll.dll windows:4 windows x86 arch:x86
7e3560e4dd2deaa398fa039458dd4b4b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
free
malloc
strerror
fflush
_errno
fopen
fread
fprintf
_vsnprintf
sprintf
ftell
fseek
fclose
clearerr
_fdopen
_initterm
_adjust_fdiv
fwrite
fputc
kernel32
DisableThreadLibraryCalls
Exports
Exports
adler32
compress
compress2
compressBound
crc32
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePrime
deflateReset
deflateSetDictionary
get_crc_table
gzclearerr
gzclose
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgets
gzopen
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzsetparams
gztell
gzungetc
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCopy
inflateEnd
inflateInit2_
inflateInit_
inflateReset
inflateSetDictionary
inflateSync
inflateSyncPoint
uncompress
zError
zlibCompileFlags
zlibVersion
Sections
.text Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
PES2013D1_Ultimate.editor.v5.3.5/说明介绍.url