C:\woza.pdb
Static task
static1
Behavioral task
behavioral1
Sample
canon_dsc_sdrc231.zip.exe
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_56ae4c3167ae5f55035d9706026e412f643b59d09b9dbce8b0ad8c8855491c62
-
Size
124KB
-
MD5
eab6ce03a942b4b8961c9bd72ac3e75c
-
SHA1
4208582ad839dee47daef7d6f51590d8d59f069d
-
SHA256
56ae4c3167ae5f55035d9706026e412f643b59d09b9dbce8b0ad8c8855491c62
-
SHA512
de6812a7679136c816a7f1f2c63660c2bb24960fda6bf60ae50a30c5655b5fd1bad39be9ae718edaaed4b7d8c0b694d637b22d2f020a274a47202af431aaf57c
-
SSDEEP
3072:G0VnJqHsm6fm1UcJtzALFUBEACVAHQjbRGrsHleXXQl5Ep4ne:rqMm6uTULFU7CVzXRKsFGm5CYe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/canon_dsc_sdrc231.zip.exe
Files
-
JaffaCakes118_56ae4c3167ae5f55035d9706026e412f643b59d09b9dbce8b0ad8c8855491c62.zip
Password: infected
-
canon_dsc_sdrc231.zip.exe.exe windows:5 windows x86 arch:x86
ababe8bfafcedeb104fe2bfafe3d518b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCommandLineW
FileTimeToDosDateTime
CreateMutexW
SetThreadContext
WriteConsoleInputW
lstrlenA
SetLocalTime
GetDefaultCommConfigW
BuildCommDCBAndTimeoutsA
FreeLibrary
CallNamedPipeA
LoadResource
SystemTimeToTzSpecificLocalTime
DeleteVolumeMountPointA
SetWaitableTimer
LoadLibraryExW
GetNumberOfConsoleMouseButtons
GetCurrentActCtx
ZombifyActCtx
GlobalSize
HeapFree
GetProfileSectionA
SetConsoleScreenBufferSize
SetComputerNameW
GetProcessPriorityBoost
VirtualFree
WriteFile
EnumTimeFormatsW
SetProcessPriorityBoost
TlsSetValue
GetPriorityClass
GetVolumeInformationA
LoadLibraryW
GetConsoleMode
SizeofResource
SetSystemTimeAdjustment
GetVersionExW
DeleteVolumeMountPointW
LeaveCriticalSection
GetFileAttributesA
VerifyVersionInfoA
GetBinaryTypeA
SetSystemPowerState
TerminateProcess
GetTimeZoneInformation
DisconnectNamedPipe
RaiseException
CreateJobObjectA
OpenMutexW
GetHandleInformation
GetLastError
GetCurrentDirectoryW
SetLastError
CreateNamedPipeA
MoveFileW
LocalAlloc
SetCommMask
GetOEMCP
DebugBreakProcess
VirtualProtect
GetSystemTime
lstrcpyA
DeleteFileA
HeapReAlloc
HeapAlloc
GetStartupInfoW
RtlUnwind
EnterCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualAlloc
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
IsValidCodePage
MultiByteToWideChar
HeapSize
LoadLibraryA
WideCharToMultiByte
GetConsoleCP
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
ReadFile
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileA
GetModuleHandleA
user32
GetWindowInfo
Exports
Exports
_helloworld@4
_reaper@8
Sections
.text Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 63KB - Virtual size: 485KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ