c:\Summer\2\Floor\then\are\78\Fall\station\33\Favor\27\20\68Voice.pdb
Static task
static1
Behavioral task
behavioral1
Sample
16a1de63c279655f8d49726d8421634e987a9cbe64d3439ef331b1c7b6d98edb.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_a98d094133f8b3b8acaaeacf699b8c956dd047baff2dc6e8001455bd91cfdfdb
-
Size
67KB
-
MD5
123740e0d788335b780090fc97d908ba
-
SHA1
108c55cf26cdde6d6dd145032718a2810d19f2ba
-
SHA256
a98d094133f8b3b8acaaeacf699b8c956dd047baff2dc6e8001455bd91cfdfdb
-
SHA512
0da243cfd3f0c95d7bc86b031a1696cc7a881e91a4bc010c78adeb1f5df7a19a2aef2db10db79dae0db178ec8fe6db48f684d11caf2a6940811df04fb9c825ec
-
SSDEEP
1536:wG4H6Di0yc5Xl20sMTYtBi7RUg0BfqprmnV8cf:wG4anyv0jTYtBwL1iBf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/16a1de63c279655f8d49726d8421634e987a9cbe64d3439ef331b1c7b6d98edb
Files
-
JaffaCakes118_a98d094133f8b3b8acaaeacf699b8c956dd047baff2dc6e8001455bd91cfdfdb.zip
Password: infected
-
16a1de63c279655f8d49726d8421634e987a9cbe64d3439ef331b1c7b6d98edb.exe windows:5 windows x86 arch:x86
e0df416457997682d881545e67987df9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
TlsAlloc
GetLocaleInfoA
HeapSize
RtlUnwind
HeapReAlloc
VirtualProtect
GetModuleFileNameA
LoadLibraryA
GetEnvironmentVariableA
Sleep
GetCurrentProcess
TlsGetValue
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
user32
CallWindowProcA
SystemParametersInfoA
AppendMenuA
FrameRect
ClientToScreen
GetMessageA
RegisterClassExA
GetClassInfoExA
GetFocus
SetFocus
GetWindowTextLengthA
GetCursorPos
gdi32
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
ScaleWindowExtEx
comctl32
ImageList_EndDrag
ImageList_GetDragImage
ImageList_Create
ImageList_GetImageCount
comdlg32
GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA
ReplaceTextA
ole32
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
avifil32
AVIFileWriteData
AVIFileReadData
AVIFileGetStream
AVIFileInit
AVIFileOpenA
AVIBuildFilterA
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ