C:\Users\ospaka\source\repos\guid\Release\guid.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2e417482a83d63f83f19dff658e7eec05ffb89c4d7b9e417eb8ec2951c4973fd.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2e417482a83d63f83f19dff658e7eec05ffb89c4d7b9e417eb8ec2951c4973fd.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_8e0a6787d446d2043bf1b04f829ae3b7d22df8c2f885b865674dc49859244502
-
Size
211KB
-
MD5
bb4ebd709a8963d7e0e40961536c9c61
-
SHA1
03be65d1cb2a97e4fe9b0ae1d8931b14d5366387
-
SHA256
8e0a6787d446d2043bf1b04f829ae3b7d22df8c2f885b865674dc49859244502
-
SHA512
39a9679ff1977e3599db5166456bbfb87eb47104d7aefcb2264e947e866da0b1e55796f26b4653a7402fc5871e51366242180274e8cd9cfc5114e94d96414676
-
SSDEEP
6144:6Lv8+EMlvnd4J0QCck7nou04pr8sid6/A:3+EM9d4/Cc8ou4sidD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/2e417482a83d63f83f19dff658e7eec05ffb89c4d7b9e417eb8ec2951c4973fd
Files
-
JaffaCakes118_8e0a6787d446d2043bf1b04f829ae3b7d22df8c2f885b865674dc49859244502.zip
Password: infected
-
2e417482a83d63f83f19dff658e7eec05ffb89c4d7b9e417eb8ec2951c4973fd.exe windows:6 windows x86 arch:x86
43c06cb0e9362c127c04b1f36a2c528b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCurrentProcess
CreateMutexA
Sleep
GetLastError
LoadLibraryA
GetProcAddress
GetTickCount
WriteConsoleW
WideCharToMultiByte
GetCurrentThreadId
CloseHandle
WaitForSingleObjectEx
SwitchToThread
RaiseException
IsProcessorFeaturePresent
QueueUserWorkItem
GetModuleHandleExW
InitOnceComplete
InitOnceBeginInitialize
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwind
ExitThread
ExitProcess
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapFree
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
CreateFileW
HeapSize
Sections
.text Size: 270KB - Virtual size: 269KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ