C:\fatol\sunipux\comuworipefiye\konemu72\tukeri.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0418508dcc93da9ade2ed5dd5a18dbcea9d98b394d206abee22bad7deaed54f8.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
0418508dcc93da9ade2ed5dd5a18dbcea9d98b394d206abee22bad7deaed54f8.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_68cfdbb6b156ddb0502ff19fe6d6f5135f13bb8f7f785167c080e3f580d1ad78
-
Size
160KB
-
MD5
2c7cc3e7f613dea6a5f835f6698f8615
-
SHA1
8ffe432e3b65e8b23ba283edae58d1aa15390e57
-
SHA256
68cfdbb6b156ddb0502ff19fe6d6f5135f13bb8f7f785167c080e3f580d1ad78
-
SHA512
da2c63d2a5392c2765f1bdbe0469d12682a803910849c8f34eec73e0d21c8bf4993ba4e719c4c0ea6a496e43eb5a251448b2c9a0bd15f5e66d19ff320554bdb6
-
SSDEEP
3072:j/+jfsyAtFANtjhqp4VbvaQqWcp/Z8OMd4tavzpxBMv1k44Zch:D+jfsyAT8jxVbiQGpgh+1k4T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/0418508dcc93da9ade2ed5dd5a18dbcea9d98b394d206abee22bad7deaed54f8
Files
-
JaffaCakes118_68cfdbb6b156ddb0502ff19fe6d6f5135f13bb8f7f785167c080e3f580d1ad78.zip
Password: infected
-
0418508dcc93da9ade2ed5dd5a18dbcea9d98b394d206abee22bad7deaed54f8.exe windows:5 windows x86 arch:x86
3922083f69b42a2089ee21c7c8579508
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FileTimeToDosDateTime
TerminateProcess
ReleaseActCtx
GetConsoleAliasesLengthA
GetVersionExA
GetConsoleOutputCP
GetDefaultCommConfigW
SetCommConfig
GetDriveTypeA
FreeEnvironmentStringsA
CreateTimerQueue
FindNextVolumeW
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
TlsGetValue
SetComputerNameExA
FindAtomA
BuildCommDCBAndTimeoutsA
LoadLibraryA
GlobalAlloc
InitializeCriticalSection
GetCommandLineW
InterlockedIncrement
CopyFileA
ZombifyActCtx
OutputDebugStringW
FormatMessageA
GetPriorityClass
WritePrivateProfileStringA
ExitThread
GlobalUnfix
HeapCompact
GetStartupInfoW
CreatePipe
GetCPInfoExW
GetWindowsDirectoryA
GetSystemWow64DirectoryA
WriteProfileSectionW
GetCalendarInfoW
ResumeThread
SetConsoleCursorInfo
SetLastError
ExitProcess
EnumDateFormatsA
GetSystemTime
GetSystemInfo
EnumCalendarInfoExW
OpenSemaphoreW
DebugActiveProcess
lstrcmpA
GetPrivateProfileSectionNamesA
GetNumberOfConsoleInputEvents
GetProcAddress
GetSystemWindowsDirectoryA
FindCloseChangeNotification
CreateActCtxA
GetPrivateProfileIntW
_lread
InterlockedDecrement
DefineDosDeviceA
SetVolumeMountPointA
EndUpdateResourceW
WriteConsoleA
VirtualProtect
FreeEnvironmentStringsW
GetMailslotInfo
lstrcpyA
VerLanguageNameW
UnlockFile
SetSystemTime
GetFileType
GetConsoleCP
GetConsoleAliasA
GetLargestConsoleWindowSize
GetOverlappedResult
FindAtomW
GetConsoleAliasExesLengthA
WriteConsoleInputA
CreateMailslotA
EnumDateFormatsW
SetCommState
LockFile
_lclose
GetConsoleAliasExesLengthW
ResetWriteWatch
CreateConsoleScreenBuffer
ClearCommBreak
ChangeTimerQueueTimer
HeapSize
GetLastError
MoveFileA
GetConsoleDisplayMode
GetStringTypeA
SetFilePointer
PostQueuedCompletionStatus
SetFileApisToOEM
OpenWaitableTimerW
GetProcessId
GetNamedPipeHandleStateA
FillConsoleOutputCharacterW
FindNextVolumeMountPointA
WriteProfileStringA
GlobalAddAtomA
WriteConsoleOutputCharacterW
TerminateJobObject
QueryDosDeviceA
GetBinaryTypeA
InitAtomTable
EnterCriticalSection
VirtualAlloc
RaiseException
HeapValidate
IsBadReadPtr
DeleteCriticalSection
LeaveCriticalSection
GetModuleFileNameW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetHandleCount
GetStdHandle
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
GetModuleFileNameA
WriteFile
HeapAlloc
HeapReAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
RtlUnwind
DebugBreak
OutputDebugStringA
WriteConsoleW
LoadLibraryW
WideCharToMultiByte
GetConsoleMode
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
SetStdHandle
CloseHandle
CreateFileA
user32
OemToCharA
winhttp
WinHttpReadData
Sections
.text Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 66KB - Virtual size: 219KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cusoro Size: 512B - Virtual size: 5B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ