c:\Shared\SpyKill\SpyPsKill\Release\nukeM_x86.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2b3f379951d31d14aa36e3eb9b6bc1c4_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2b3f379951d31d14aa36e3eb9b6bc1c4_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2b3f379951d31d14aa36e3eb9b6bc1c4_JaffaCakes118
-
Size
104KB
-
MD5
2b3f379951d31d14aa36e3eb9b6bc1c4
-
SHA1
38344d288c57ee60d2c3c0a8900f3fed6b21d2e8
-
SHA256
ffe9121c0aa6c237d47d7c8eff99d721071197408b383ad417cfd735d8563ce6
-
SHA512
16f60400a8184488886cf67b67b48c0c22b1a7f1982cd106d5b4ee6aa35cf60b7e604bb3a6a4913399ce38de90e2628f5dc6a22473e61fd166bf8324a8b5cec0
-
SSDEEP
1536:kAexJ3pTnTHUFUn9PAy3p+hr0yCtPMT6xzpWoH0xc2xt1ahrvw:lexJ3lBdpkoxzpWoH0xcWt1aC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b3f379951d31d14aa36e3eb9b6bc1c4_JaffaCakes118
Files
-
2b3f379951d31d14aa36e3eb9b6bc1c4_JaffaCakes118.exe windows:4 windows x86 arch:x86
ea408df51424cabe773671360583a3ed
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
kernel32
GetWindowsDirectoryA
OpenProcess
GetSystemInfo
GetCurrentProcessId
TerminateProcess
GetVersionExA
LocalFree
GetLastError
GetProcAddress
GetCurrentProcess
LoadLibraryA
GetCurrentDirectoryA
CloseHandle
GetStartupInfoA
WriteConsoleW
GetConsoleOutputCP
HeapAlloc
HeapFree
GetCommandLineA
GetProcessHeap
RaiseException
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
ExitProcess
WriteFile
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
Sleep
CreateFileA
InitializeCriticalSection
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
SetEndOfFile
ReadFile
WriteConsoleA
advapi32
ConvertSidToStringSidA
AdjustTokenPrivileges
IsValidSid
LookupPrivilegeValueA
GetTokenInformation
OpenProcessToken
RegCloseKey
RegSetValueExA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
shell32
ShellExecuteA
Sections
.text Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ