E:\mtasa-blue-master (2)\mtasa-blue-master\Bin\Multi Theft Auto.pdb
Behavioral task
behavioral1
Sample
JaffaCakes118_1fab9fc9e8d75809680e847f039c052a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1fab9fc9e8d75809680e847f039c052a.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_1fab9fc9e8d75809680e847f039c052a
-
Size
369KB
-
MD5
1fab9fc9e8d75809680e847f039c052a
-
SHA1
52ff303fcc2b2cef168fe078a46d3eeff6ee19dc
-
SHA256
2b404fb3d9c89fdd5a31a1407a6fb08976fd3b1b451d4968de8c4c930645f988
-
SHA512
93cc769ebf64da46b280b7aa6999d2f4216c5668390ba4ac62f827c297175d28a34366427d021f8d38257b6281d202ccf038f1e8c9ca9de4ca3efb3b9aa4a27b
-
SSDEEP
6144:aVWdtcJPqwwlV8eCeEUSmM7iGuF6I/jcsNMihkHx8CtxHx8CtPmj490tn0:awcVTwldCeoV7iGuF6I/jcAPfCuC4jty
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
resource yara_rule sample family_neshta -
Neshta family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_1fab9fc9e8d75809680e847f039c052a
Files
-
JaffaCakes118_1fab9fc9e8d75809680e847f039c052a.exe windows:6 windows x86 arch:x86
b73e837f96eee14e9873946203d6e91d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateFileW
FindClose
FindNextFileW
GetFileAttributesA
GetFullPathNameW
GetLongPathNameW
ReadFile
SetFileAttributesA
CloseHandle
QueryPerformanceCounter
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThread
GetCurrentThreadId
GetSystemTime
GetLocalTime
GetModuleFileNameW
GlobalAlloc
GlobalUnlock
GlobalLock
LocalFree
FormatMessageW
VerifyVersionInfoW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WriteConsoleW
SetEndOfFile
DecodePointer
HeapReAlloc
HeapSize
FlushFileBuffers
GetProcessHeap
GetStringTypeW
VerSetConditionMask
LoadLibraryW
GetProcAddress
FreeLibrary
SetErrorMode
GetLastError
GetThreadTimes
SetCurrentDirectoryW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
WaitForSingleObjectEx
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
WideCharToMultiByte
SetEvent
ResetEvent
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
EncodePointer
LoadLibraryExW
RaiseException
RtlUnwind
CreateDirectoryW
GetModuleHandleExW
GetStdHandle
WriteFile
ExitProcess
HeapFree
HeapAlloc
MultiByteToWideChar
GetFileType
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
GetFileSizeEx
LCMapStringW
user32
OpenClipboard
MessageBoxW
EmptyClipboard
SetClipboardData
CloseClipboard
advapi32
RegQueryValueExW
RegOpenKeyExW
RegFlushKey
RegCreateKeyExW
RegCloseKey
RegSetValueExW
shell32
ShellExecuteA
ShellExecuteExW
SHGetFolderPathW
winmm
timeGetTime
Exports
Exports
GetLibMtaVersion
Sections
.text Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ