C:\lokoruxen.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b4489e07ddca61504faf50141f55f91e68976a2c39d1d852eb274ce62dbbb5fe.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b4489e07ddca61504faf50141f55f91e68976a2c39d1d852eb274ce62dbbb5fe.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_aaf7e472921922ade1e7c9cb27e35c1dc708cb6d45483d37071602136b20ba26
-
Size
4.3MB
-
MD5
cfad8bfb3c2074751ae4e9f724635744
-
SHA1
d6a64b37ebfe11079f941616c75d0cde8fd6d0c8
-
SHA256
aaf7e472921922ade1e7c9cb27e35c1dc708cb6d45483d37071602136b20ba26
-
SHA512
bd2ad348018b8804f5d6eb2100ea8a3fcb3ce08997638b72c077e5fd0d9c1a28e0b74f7ee50b3fbf685649fdebede135100c8cf5343a399c81e1ffd749497e14
-
SSDEEP
98304:TyNCpIHyWoh85u+ACGFwazWxjniMvSqqhRVriNd7UUDUeq:TyKYborFHimcCrOvq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/b4489e07ddca61504faf50141f55f91e68976a2c39d1d852eb274ce62dbbb5fe
Files
-
JaffaCakes118_aaf7e472921922ade1e7c9cb27e35c1dc708cb6d45483d37071602136b20ba26.zip
Password: infected
-
b4489e07ddca61504faf50141f55f91e68976a2c39d1d852eb274ce62dbbb5fe.exe windows:5 windows x86 arch:x86
f15a946d6e0659432dc9b8c464554438
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CopyFileExW
TlsGetValue
SetLocalTime
GetDriveTypeW
SetEndOfFile
GetNumberOfConsoleInputEvents
FindResourceExW
MapUserPhysicalPages
CallNamedPipeA
InterlockedIncrement
GetQueuedCompletionStatus
GetCommState
InterlockedDecrement
ScrollConsoleScreenBufferW
GetModuleHandleW
WriteFileGather
CreateDirectoryExW
Sleep
GetSystemTimeAdjustment
GlobalFlags
Beep
VerifyVersionInfoA
IsDBCSLeadByte
ReadFile
CreateFileW
GetBinaryTypeW
GetACP
lstrlenW
VerifyVersionInfoW
CreateDirectoryA
GetStdHandle
FindFirstFileA
OpenMutexW
GetCurrentDirectoryW
GetProcAddress
SetVolumeLabelW
WriteProfileSectionA
WriteConsoleInputW
SetComputerNameA
CreateMemoryResourceNotification
SearchPathA
GetPrivateProfileStringA
SetFileApisToOEM
GetAtomNameA
Process32FirstW
OpenWaitableTimerW
LocalAlloc
IsSystemResumeAutomatic
SetConsoleOutputCP
AddAtomW
SetCommMask
GetPrivateProfileStructA
EnumResourceTypesW
SetConsoleTitleW
GetModuleHandleA
FreeEnvironmentStringsW
EnumResourceNamesA
GetConsoleTitleW
BuildCommDCBA
CompareStringA
GetConsoleCursorInfo
SetCalendarInfoA
GetVersionExA
GetWindowsDirectoryW
GetCurrentProcessId
InterlockedPushEntrySList
GetProfileSectionW
SuspendThread
LCMapStringW
GetVolumeInformationW
SetFilePointer
SetStdHandle
CloseHandle
RaiseException
ReadFileEx
GetFileSize
GetCommandLineW
HeapSetInformation
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
DecodePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
GetModuleFileNameW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
ExitProcess
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapValidate
IsBadReadPtr
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetLastError
HeapCreate
WriteFile
RtlUnwind
GetOEMCP
GetCPInfo
IsValidCodePage
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
MultiByteToWideChar
HeapAlloc
GetModuleFileNameA
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
GetStringTypeW
WideCharToMultiByte
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsProcessorFeaturePresent
user32
GetMenuBarInfo
GetComboBoxInfo
GetMessageTime
advapi32
InitiateSystemShutdownW
Exports
Exports
_CallPattern@8
_futurama@4
_hiduk@8
_zabiray@8
Sections
.text Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 45.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ