Static task
static1
Behavioral task
behavioral1
Sample
ROMeo's Multihabck/ROMeo's Multihack.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ROMeo's Multihabck/ROMeo's Multihack.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
scrutinizer/options.js
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
scrutinizer/options.js
Resource
win10v2004-20240508-en
General
-
Target
7cd94928e63d3b7743e6e9443e7d9c46_JaffaCakes118
-
Size
143KB
-
MD5
7cd94928e63d3b7743e6e9443e7d9c46
-
SHA1
10fe2de23fb881a306841cee0375b73c49eb038b
-
SHA256
9fd9c02e5549f32d9d6bab8ae368aa1ae1f349670de625ddf6b85afa4ddef127
-
SHA512
f8df34617c457097ab380f6940e70fb6c5cd65147b419c63b34d62c8d1502bbcf7d3169b48ab280ecc27e5ee2c4f697faa32b57550c4f0dec11cd77cd2a105ce
-
SSDEEP
3072:kgex/zQcX3ESps1LGQ9Gi6NwUBnRQg4M6WCbuCd4RNTw:z6/zQSU71qQ9MLfQ/MJCb2NU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ROMeo's Multihabck/ROMeo's Multihack.exe
Files
-
7cd94928e63d3b7743e6e9443e7d9c46_JaffaCakes118.rar
-
ROMeo's Multihabck/CurHackVariables.txt
-
ROMeo's Multihabck/CurPatchPtrs.txt
-
ROMeo's Multihabck/ErrorLog.txt
-
ROMeo's Multihabck/ROMeo's Multihack.exe.exe windows:4 windows x86 arch:x86
ffd76c8bbdd32b29811f07cf117d7235
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
AddAtomA
CloseHandle
CreateSemaphoreA
ExitProcess
FillConsoleOutputCharacterA
FindAtomA
FlushConsoleInputBuffer
GetAtomNameA
GetConsoleWindow
GetExitCodeProcess
GetLastError
GetPrivateProfileStringA
GetStdHandle
InterlockedDecrement
InterlockedIncrement
OpenProcess
ReadProcessMemory
ReleaseSemaphore
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleScreenBufferSize
SetConsoleTextAttribute
SetConsoleTitleA
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtectEx
WaitForSingleObject
WriteProcessMemory
msvcrt
_fdopen
_read
_strdup
_write
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_ctype
_errno
_filbuf
_filelengthi64
_fstati64
_iob
_isctype
_lseeki64
_onexit
_pctype
_setmode
_strdate
_strnicmp
_strtime
_vsnprintf
abort
atexit
atoi
clock
difftime
exit
fclose
fflush
fgetpos
fopen
fprintf
fread
free
fsetpos
fwrite
getc
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
printf
putc
setlocale
setvbuf
signal
sprintf
strcmp
strcoll
strcpy
strftime
strlen
strncpy
strstr
strtod
strxfrm
time
ungetc
user32
DrawMenuBar
EnableMenuItem
FindWindowA
FindWindowExA
GetAsyncKeyState
GetForegroundWindow
GetKeyState
GetSystemMenu
GetWindowThreadProcessId
SetWindowPos
SetWindowTextA
Sections
.text Size: 276KB - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 416B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 25KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
ROMeo's Multihabck/hotkeys.ini
-
ROMeo's Multihabck/scrutinizer.zip.zip
-
scrutinizer/bossids.lua
-
scrutinizer/colors.lua
-
scrutinizer/detail.lua
-
scrutinizer/detailframe.xml
-
scrutinizer/main.lua
-
scrutinizer/mainframe.xml
-
scrutinizer/options.lua.js
-
scrutinizer/scrutinizer.toc
-
scrutinizer/send.lua
-
scrutinizer/sendto.xml
-
scrutinizer/slash.lua
-
scrutinizer/submit.xml
-
scrutinizer/templates.xml
-
scrutinizer/texture/background.tga
-
scrutinizer/tooltips.lua
-
scrutinizer/utilities.lua