Static task
static1
Behavioral task
behavioral1
Sample
dhcpfind.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
dhcpfind.exe
Resource
win10v2004-20240426-en
General
-
Target
66d24ab06c41ec5c06a03f5ee6c5ece9_JaffaCakes118
-
Size
41KB
-
MD5
66d24ab06c41ec5c06a03f5ee6c5ece9
-
SHA1
1724a844d5e22d47d0321f08203fc94ed5c45d82
-
SHA256
6cd3fc88ab65b786f97b116dec1fff262ebeee99f54b2a132616bbfa787d6595
-
SHA512
35024962b0524103f5f01e55d562f9d953fb7f2dfdeb1d277c6c2d8e2a7c9935cac6f9730323902291179ad21c957a1c1e298547375b16933164d62444b0307e
-
SSDEEP
768:+gfnxlMurbLYDmB0hLPbAdxmrTQqG7Xt4btufnpBvzLNgqLzs7KCDdA/KcDU+Mjv:+SxiurvRB0hLPbAd0vUikfpBvdef4A+c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/dhcpfind.exe
Files
-
66d24ab06c41ec5c06a03f5ee6c5ece9_JaffaCakes118.zip
-
dhcpfind.exe.exe windows:4 windows x86 arch:x86
bddcea001540ad0194b678c015448f5f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetStringTypeA
SetEndOfFile
GetOEMCP
GetACP
GetCPInfo
CreateThread
LoadLibraryA
GetProcAddress
ReadFile
GetTickCount
CreateFileA
FlushFileBuffers
SetStdHandle
HeapReAlloc
VirtualAlloc
HeapAlloc
SetFilePointer
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
GetLastError
CloseHandle
WriteFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeW
user32
SendMessageA
EndDialog
DialogBoxParamA
PostQuitMessage
ShowWindow
PostMessageA
GetDlgItem
SetDlgItemInt
advapi32
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
shell32
ShellExecuteA
ws2_32
WSAStartup
WSACleanup
bind
htons
socket
sendto
recvfrom
setsockopt
snmpapi
SnmpUtilOidNCmp
SnmpUtilOidCpy
SnmpUtilVarBindFree
Sections
.text Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ