Static task
static1
Behavioral task
behavioral1
Sample
winject_dlja_css_v34/Winject.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
winject_dlja_css_v34/Winject.exe
Resource
win10v2004-20240426-en
General
-
Target
816d03855e2cf2e0840dccab3ff43a53_JaffaCakes118
-
Size
56KB
-
MD5
816d03855e2cf2e0840dccab3ff43a53
-
SHA1
a8b3f071828c651f6e20993170ffb149987a6642
-
SHA256
e7e8fea3d5d296474ec0d2ac09c21a74e56a438ef13bbbaf21166e2ca31db7b4
-
SHA512
6c151e234fdb7a0f9e47c00284ac46834adf49112fa126036777ce7b8655a77aecafd5429e37cf7dbd5a39926536da5dd211e9a57bc174b3006c1fcae2c3587e
-
SSDEEP
768:sJtkZzCPOVGnLcrljrCYfEyQLcVs7LDGmaf56aKbMEOdbvl1XgptwFMVbzlHHQtb:Guc2GLcBjHSMaLqX6aKHslyqqphrD6we
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/winject_dlja_css_v34/Winject.exe
Files
-
816d03855e2cf2e0840dccab3ff43a53_JaffaCakes118.rar
-
winject_dlja_css_v34/Winject.exe.exe windows:4 windows x86 arch:x86
6d3e5814450a38a649e01d0651a6e25e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
LoadLibraryA
GetExitCodeThread
LocalFree
FormatMessageA
UnmapViewOfFile
MapViewOfFile
LocalAlloc
DebugActiveProcess
TerminateProcess
FreeLibrary
GetFileSize
CreateFileA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
SetFilePointer
HeapReAlloc
VirtualAlloc
WriteFile
RtlUnwind
VirtualFreeEx
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
SuspendThread
FlushFileBuffers
FlushInstructionCache
SetThreadContext
CreateProcessA
ResumeThread
VirtualProtectEx
GetLastError
Module32First
Module32Next
GetModuleFileNameA
OpenProcess
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
CloseHandle
Process32Next
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetThreadContext
GetTickCount
SetUnhandledExceptionFilter
RaiseException
Sleep
IsDebuggerPresent
GetCurrentProcessId
GetCurrentProcess
VirtualFree
ReadProcessMemory
winmm
PlaySoundA
shlwapi
PathRemoveFileSpecA
PathCompactPathA
PathStripPathA
comdlg32
GetOpenFileNameA
user32
EnableMenuItem
DlgDirListComboBoxA
GetMenu
CheckMenuItem
GetAsyncKeyState
GetDlgItemTextA
SetFocus
DialogBoxParamA
GetDC
DrawIcon
ReleaseDC
KillTimer
GetSysColorBrush
EnableWindow
SetTimer
GetDesktopWindow
GetWindow
ShowWindow
GetClassLongA
GetClientRect
InvalidateRect
UpdateWindow
GetWindowThreadProcessId
MessageBoxA
FindWindowA
FindWindowExA
EnumWindows
SetWindowTextA
GetSysColor
SetRect
DrawIconEx
GetDlgItem
LoadIconA
SendMessageA
EndDialog
GetWindowTextA
GetDialogBaseUnits
MoveWindow
SendMessageTimeoutA
SetDlgItemTextA
advapi32
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
RegDeleteKeyA
OpenProcessToken
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
gdi32
CreateFontA
SelectObject
DeleteObject
SetBkColor
SetTextColor
SetBkMode
GetTextExtentPoint32A
GetTextMetricsA
ExtTextOutA
Sections
.text Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ