CreateInterface
Static task
static1
Behavioral task
behavioral1
Sample
][[[SEX]]][ Public HooK 1.0/[[[SEX]]].dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
][[[SEX]]][ Public HooK 1.0/[[[SEX]]].dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
][[[SEX]]][ Public HooK 1.0/[[[SEX]]].exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
][[[SEX]]][ Public HooK 1.0/[[[SEX]]].exe
Resource
win10v2004-20240508-en
General
-
Target
5e6376af48d2dcbc0be1bb89c19338ea_JaffaCakes118
-
Size
163KB
-
MD5
5e6376af48d2dcbc0be1bb89c19338ea
-
SHA1
85f21fe380158dd26daebc1fffa8627ca8eccb3a
-
SHA256
bd39841c228f10348fac9d8bf24910484d578d0d2783b79d241314756d40667c
-
SHA512
8790ffc90b0096d89e12aa6bcbacb629e3fc0be6f93ff88d0dd76b5d90b164bfff9ba2f0c5992e0748b72107a943bb8dcedb6c61d2d30c66d16f941cfe64e4e6
-
SSDEEP
3072:7mEPGqRVcYbFQPFg2B+E9I0dbwtyd1H/L0m9RLaj1bFxFToL7iVchFms8xFs9hp:BPVRVcHtgMkYbwt8fwIsbxFTO7yeFmc
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/][[[SEX]]][ Public HooK 1.0/[[[SEX]]].dll unpack001/][[[SEX]]][ Public HooK 1.0/[[[SEX]]].exe
Files
-
5e6376af48d2dcbc0be1bb89c19338ea_JaffaCakes118.rar
-
][[[SEX]]][ Public HooK 1.0/[[[SEX]]].dll.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
nsp0 Size: - Virtual size: 432KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nsp1 Size: 139KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
][[[SEX]]][ Public HooK 1.0/[[[SEX]]].exe.exe windows:4 windows x86 arch:x86
2f2ffcfdf54a4f2069be65b08933ef30
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalFree
GlobalAlloc
OpenProcess
CloseHandle
SetThreadContext
SuspendThread
Sleep
ResumeThread
WriteProcessMemory
VirtualProtectEx
GetThreadContext
GetModuleHandleA
ReadProcessMemory
CreateRemoteThread
ExitProcess
LoadLibraryA
FindFirstFileA
GetWindowsDirectoryA
TerminateProcess
CreateProcessA
SetCurrentDirectoryA
DeleteFileA
GetModuleFileNameA
GetExitCodeThread
WaitForSingleObject
GetStartupInfoA
GetStdHandle
GetFileType
GetOEMCP
GetACP
SetEndOfFile
GetVersion
GetProcAddress
GetCommandLineA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapFree
GetLastError
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
HeapAlloc
VirtualAlloc
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
GetStringTypeA
GetStringTypeW
FlushFileBuffers
HeapReAlloc
SetStdHandle
SetFilePointer
ReadFile
CreateFileA
GetCPInfo
user32
MessageBoxA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
][[[SEX]]][ Public HooK 1.0/[[[SEX]]].ini
-
][[[SEX]]][ Public HooK 1.0/commandmenu.txt
-
][[[SEX]]][ Public HooK 1.0/main.cfg
-
][[[SEX]]][ Public HooK 1.0/说明.txt