D:\bin_kp\KPDown\KPDown@86_1_121330.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9d7516c4f3497d425fa961c9067cd9cc_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9d7516c4f3497d425fa961c9067cd9cc_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9d7516c4f3497d425fa961c9067cd9cc_JaffaCakes118
-
Size
641KB
-
MD5
9d7516c4f3497d425fa961c9067cd9cc
-
SHA1
f0cfc33b817392c8f77c7777c47a067a17c0c738
-
SHA256
66ee44d9ba65e9e8f5d2bfd5f6867965afcf79bd09da0c62f0cb2f3e6be0ab44
-
SHA512
066c184c80efad41abdb94339462671b9b6c45c2d77f8e829ed5aaa45de31d6893049b7457f9b1432d55be6a131f29031034e6690a962ea3a9829f3955fd6579
-
SSDEEP
12288:t/drzxG/UVkC9e/EIn3LJ0omXcuNYYioOP3uSMbhVNMUuqBQu5y5R/gdkj3yh:t/hcg9esInbJ0x2ySwhXMUuqBQu5ypg3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9d7516c4f3497d425fa961c9067cd9cc_JaffaCakes118
Files
-
9d7516c4f3497d425fa961c9067cd9cc_JaffaCakes118.exe windows:5 windows x86 arch:x86
2a56e0f8c7319302b6c524e6da5b5ed4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetSystemInfo
DeleteCriticalSection
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetPrivateProfileStringW
InitializeCriticalSectionAndSpinCount
GetVersionExW
ResumeThread
GetTickCount
Sleep
GetFileSize
DosDateTimeToFileTime
SetFilePointer
GetCurrentDirectoryW
GetFileType
SetUnhandledExceptionFilter
CreateMutexW
lstrlenW
lstrcatW
lstrcmpW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
lstrcmpiW
lstrcpyW
CreateEventW
FindNextFileW
IsProcessorFeaturePresent
EnterCriticalSection
InterlockedExchange
LeaveCriticalSection
InitializeCriticalSection
SetEvent
InterlockedCompareExchange
WaitForSingleObject
ExpandEnvironmentStringsA
LoadLibraryA
GetStdHandle
WaitForMultipleObjects
PeekNamedPipe
FormatMessageA
VerSetConditionMask
VerifyVersionInfoA
SleepEx
SetLastError
QueryPerformanceCounter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
HeapSetInformation
DecodePointer
EncodePointer
SetFileAttributesW
LockResource
GlobalFree
GetLastError
GlobalUnlock
SizeofResource
GlobalAlloc
GlobalLock
LoadResource
FindResourceW
LoadLibraryW
FreeLibrary
CloseHandle
FindClose
CreateFileW
ReadFile
WriteFile
SetFileTime
CreateDirectoryW
FindFirstFileW
GetProcAddress
GetModuleHandleW
IsDebuggerPresent
GetModuleFileNameW
WideCharToMultiByte
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetTempPathW
MultiByteToWideChar
user32
GetClientRect
GetFocus
GetKeyState
KillTimer
SetCapture
RegisterWindowMessageW
GetMessageW
GetWindowRect
ScreenToClient
SetTimer
UpdateLayeredWindow
DestroyWindow
ClientToScreen
EndPaint
DefWindowProcW
CallWindowProcW
GetPropW
EnableWindow
RegisterClassExW
SetPropW
GetClassInfoExW
LoadCursorW
PostMessageW
PostQuitMessage
OffsetRect
InflateRect
SetCursor
SetWindowTextW
GetWindowTextW
IsWindowVisible
MapWindowPoints
SendMessageW
GetSystemMenu
wsprintfW
SetFocus
MessageBoxW
IsWindow
ReleaseDC
IntersectRect
GetDC
LoadImageW
DestroyMenu
GetWindow
EnableMenuItem
GetSystemMetrics
ShowWindow
BeginPaint
PtInRect
SystemParametersInfoW
GetParent
CharNextW
GetUpdateRect
TranslateMessage
InvalidateRect
GetWindowLongW
IsRectEmpty
DispatchMessageW
SetWindowLongW
SetWindowPos
GetCursorPos
CreateWindowExW
GetWindowTextLengthW
ReleaseCapture
gdi32
CreateRectRgnIndirect
SelectClipRgn
SetWindowOrgEx
GetClipBox
SetBkMode
SetTextColor
CombineRgn
RestoreDC
GetStockObject
BitBlt
GetTextMetricsW
DeleteDC
CreateDIBSection
CreateFontIndirectW
SaveDC
ExtSelectClipRgn
CreateRoundRectRgn
StretchBlt
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
SetStretchBltMode
CreateSolidBrush
GetObjectA
advapi32
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextA
CryptImportKey
CryptReleaseContext
CryptEncrypt
CryptDestroyKey
RegOpenKeyExW
CryptCreateHash
shell32
ShellExecuteExW
SHFileOperationW
ShellExecuteW
SHGetFolderPathW
SHGetSpecialFolderPathW
ole32
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoInitializeEx
OleInitialize
OleUninitialize
CoCreateInstance
msvcp100
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
??0_Locinfo@std@@QAE@HPBD@Z
??1_Locinfo@std@@QAE@XZ
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@QAEXXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
??1_Locimp@locale@std@@MAE@XZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?ends@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0_Locimp@locale@std@@AAE@_N@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
?unshift@?$codecvt@_WDH@std@@QBEHAAHPAD1AAPAD@Z
?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?endl@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Init@locale@std@@CAPAV_Locimp@12@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xruntime_error@std@@YAXPBD@Z
?id@?$codecvt@_WDH@std@@2V0locale@2@A
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_BADOFF@std@@3_JB
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
shlwapi
PathFileExistsW
PathIsDirectoryW
SHSetValueW
PathFindFileNameW
StrCpyW
PathAddBackslashW
dbghelp
MiniDumpWriteDump
msvcr100
_commode
_write
_read
_open
_close
_strnicmp
_stricmp
_strdup
isgraph
isprint
_gmtime64
fseek
getenv
atoi
_lseeki64
_fstat64
_getpid
isalnum
__sys_nerr
strerror
fgets
fputs
qsort
_strtoi64
strpbrk
strstr
isxdigit
sscanf
_errno
__iob_func
fopen
fread
strchr
strrchr
memcpy
_stat64
memset
_controlfp_s
_invoke_watson
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__set_app_type
_fmode
_CxxThrowException
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CxxFrameHandler3
rand
srand
setlocale
_gmtime32
calloc
wcsstr
_wtoi
strtoul
realloc
strtol
_beginthreadex
wcstoul
wcstol
malloc
free
fputc
_purecall
_time64
fclose
fwrite
memcpy_s
fgetwc
_lock_file
setvbuf
_vswprintf_c_l
fsetpos
fgetc
fflush
_fseeki64
fgetpos
ungetc
ungetwc
_unlock_file
fputwc
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
memmove
??3@YAXPAX@Z
??2@YAPAXI@Z
??_V@YAXPAX@Z
sprintf
towlower
wcsncpy
tolower
strncpy
isalpha
isupper
toupper
islower
isspace
memchr
isdigit
strftime
_localtime64
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
strncmp
gdiplus
GdipCreateFromHDC
GdipSetStringFormatFlags
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipCreateBitmapFromResource
GdipDisposeImage
GdipDeleteBrush
GdipFree
GdipDeletePen
GdipCloneBrush
GdipCreateFontFromLogfontA
GdipGetImageHeight
GdipLoadImageFromStream
GdipCreateFontFromDC
GdipDeleteStringFormat
GdipCreatePen1
GdipReleaseDC
GdipSetStringFormatTrimming
GdipCreateStringFormat
GdipSetStringFormatHotkeyPrefix
GdipSetPenDashStyle
GdipDrawLineI
GdipFillRectangleI
GdipGetImageWidth
GdipGetDC
GdipDrawString
GdipCreateHatchBrush
GdipAlloc
GdipSetPenColor
GdipCreateSolidFill
GdipSetStringFormatAlign
GdipDeleteGraphics
GdipDeleteFont
GdipSetTextRenderingHint
GdipSetStringFormatLineAlign
GdipMeasureString
GdipDrawImageRectRectI
iphlpapi
GetAdaptersInfo
comctl32
_TrackMouseEvent
InitCommonControlsEx
urlmon
URLDownloadToFileW
ws2_32
connect
freeaddrinfo
socket
sendto
recvfrom
accept
listen
gethostname
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
getaddrinfo
WSACleanup
closesocket
ioctlsocket
wldap32
ord26
ord143
ord211
ord50
ord60
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord46
ord22
Sections
.text Size: 453KB - Virtual size: 453KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ