D:\workspace\Projects\KMC\StatusMonitor\Release\KMSTMNET.pdb
Behavioral task
behavioral1
Sample
69cade9f6ef268fa59cb7c68fb77fa64_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
69cade9f6ef268fa59cb7c68fb77fa64_JaffaCakes118
-
Size
649KB
-
MD5
69cade9f6ef268fa59cb7c68fb77fa64
-
SHA1
77575384edf3c9689b7d90eb3096f553280b14f9
-
SHA256
035ab58d77fc3c1c35295c984ce5c78dbb579e49f955f8ec6c487fe133f73891
-
SHA512
eba9949178881769480ec7d940e73346cf47659f473edcc8d494096c5014534f0033665ff466e7998eb2fce385d58f5decad54848eb9f6e7ce0e944d1722d3e2
-
SSDEEP
12288:t+hPcGIWu2gLAS3BtWG16Xqa05IPGCZ2UuO3G51y6TqvNtQARFRjrb:tocGI++kR0lhO3GzdqvNtRRFJb
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 69cade9f6ef268fa59cb7c68fb77fa64_JaffaCakes118
Files
-
69cade9f6ef268fa59cb7c68fb77fa64_JaffaCakes118.exe windows:5 windows x86 arch:x86
f614faa5af831f93308ee0b5e4ce38f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
getsockopt
sendto
recvfrom
setsockopt
bind
listen
accept
ioctlsocket
send
recv
ntohl
select
__WSAFDIsSet
gethostname
socket
connect
closesocket
WSACleanup
htons
getservbyname
inet_addr
htonl
gethostbyname
getservbyport
ntohs
gethostbyaddr
WSAGetLastError
inet_ntoa
WSASetLastError
WSAStartup
kernel32
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCurrentDirectoryA
GetFullPathNameA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
WideCharToMultiByte
GetACP
CreateFileW
WriteFile
GetLastError
MultiByteToWideChar
CreateMutexW
FindClose
FindFirstFileA
GetTickCount
CreateDirectoryA
GetCurrentThreadId
GetVersion
GetStringTypeA
GetStdHandle
WriteConsoleW
GlobalMemoryStatus
QueryPerformanceCounter
CloseHandle
GetVersionExA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetCPInfo
RaiseException
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetCommandLineW
SetHandleCount
VirtualAlloc
GetStringTypeW
GetModuleHandleA
RtlUnwind
ReadFile
SetStdHandle
SetFilePointer
HeapSize
GetLocaleInfoW
WriteConsoleA
GetFileType
GetConsoleOutputCP
DeleteCriticalSection
VirtualFree
HeapCreate
CompareStringA
CompareStringW
SetEnvironmentVariableA
CreateFileA
SetEndOfFile
GetProcessHeap
GetCurrentProcessId
SetEnvironmentVariableW
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
Sleep
ExitProcess
GetStartupInfoW
HeapAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
HeapReAlloc
GetTimeZoneInformation
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
user32
KillTimer
LoadStringW
LoadIconW
LoadCursorW
MessageBoxA
GetDesktopWindow
GetUserObjectInformationW
DispatchMessageW
TranslateMessage
GetMessageW
PostMessageW
IsWindow
GetProcessWindowStation
SetTimer
PostQuitMessage
GetWindowLongW
DefWindowProcW
SetWindowLongW
UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassExW
winspool.drv
GetPrinterDataW
ClosePrinter
OpenPrinterW
advapi32
DeregisterEventSource
RegOpenKeyExA
OpenEventLogA
ReportEventA
CloseEventLog
RegQueryValueExA
RegCloseKey
RegisterEventSourceA
Sections
.text Size: 420KB - Virtual size: 420KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 100KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE