d:\Work\CODE\NetSpy\Distr\KGBSpy\Mpk64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c8241996203399e271bb3591dbde255a_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c8241996203399e271bb3591dbde255a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c8241996203399e271bb3591dbde255a_JaffaCakes118
-
Size
2.1MB
-
MD5
c8241996203399e271bb3591dbde255a
-
SHA1
fd7e0d9e81c100272ecb8c40099f1e2ca9c3a86e
-
SHA256
d48a02d1d7ada67611a777be64dbbaacd57924f9ff0a8eaad1972547f9569256
-
SHA512
65c392f62cc9416e1f03437f9adab907790b1abbce071c3a3d0765a42319877930d37818d32cf7bf40b8acb1aa3ff849cbaf7d245bfdb6829d4843f6d753512d
-
SSDEEP
24576:5VOwrWPAlch9AsGyXvE/clq+9Au8cxqQSQ2IJe9E+r9xkPofGhIk3/fRxdTH7V1n:1rSAleMGtfhFe9nrcPyGhDfRHTH7Ttp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8241996203399e271bb3591dbde255a_JaffaCakes118
Files
-
c8241996203399e271bb3591dbde255a_JaffaCakes118.exe windows:4 windows x64 arch:x64
93090c9e6c5b3dac2375b452eeadf055
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
CreateFileMappingW
GetLastError
MapViewOfFile
UnmapViewOfFile
CloseHandle
LocalFree
LocalAlloc
OpenMutexW
CreateMutexW
lstrlenW
GetCurrentProcessId
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryW
GetModuleFileNameW
lstrcatW
GetCurrentProcess
TerminateProcess
GetStartupInfoW
Sleep
user32
EndPaint
BeginPaint
CreateWindowExW
RegisterClassExW
DispatchMessageW
TranslateMessage
GetMessageW
DefWindowProcW
PostQuitMessage
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
msvcr80
_XcptFilter
_exit
_cexit
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
_encode_pointer
__set_app_type
__crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
__C_specific_handler
__wgetmainargs
_amsg_exit
wcsstr
memset
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ