D:\免杀\5星FbRobotEsty\5星FbRobotEsty\Release\FbRobot.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dcd0da0e2a4791de9578d997e9022710e9c88414c4421a95988897b61e4841ba.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_e83bc1de2907898b48b90bc84a692568cab2213a852453cca76bc40c7313b60e
-
Size
4.2MB
-
MD5
e0c4ac891a6f9cb2f4b0d88a5686f52c
-
SHA1
5f0250967ada63ac4ccf2daf35ae784647a34bad
-
SHA256
e83bc1de2907898b48b90bc84a692568cab2213a852453cca76bc40c7313b60e
-
SHA512
c2f4af77c1be580d0ed0d6a386313558a8baf28b053bf6a4834b0935b03596e67976e4ccef2cf4bc5716f0b13135fc0dc9d6bf11cf39335746101ded5f0cc151
-
SSDEEP
98304:7wKUfHNuCQtTytf74FHZXpKDF/g/KYQIDWjicFvmyjPXrZO50PMp6IeeUxF:720RTytfAHtSI/KY1WVvZr7ZxEyeOF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/dcd0da0e2a4791de9578d997e9022710e9c88414c4421a95988897b61e4841ba
Files
-
JaffaCakes118_e83bc1de2907898b48b90bc84a692568cab2213a852453cca76bc40c7313b60e.zip
Password: infected
-
dcd0da0e2a4791de9578d997e9022710e9c88414c4421a95988897b61e4841ba.exe windows:5 windows x86 arch:x86
1c58abcb8cbe61a28423487fc0e86742
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
VirtualProtect
user32
SetParent
gdi32
CreateRectRgn
msimg32
AlphaBlend
winspool.drv
ClosePrinter
comctl32
InitCommonControlsEx
shlwapi
StrFormatKBSizeW
ole32
IsAccelerator
oleaut32
LoadTypeLi
oledlg
OleUIBusyW
gdiplus
GdipCreateBitmapFromStream
winhttp
WinHttpQueryHeaders
quartz
AMGetErrorTextW
oleacc
AccessibleObjectFromWindow
imm32
ImmGetContext
winmm
PlaySoundW
crypt32
CertFindCertificateInStore
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
advapi32
RegDeleteKeyA
shell32
SHGetFolderPathW
Sections
.text Size: 2.9MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sdata Size: 752KB - Virtual size: 752KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 81KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sdata Size: 572KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE