Static task
static1
Behavioral task
behavioral1
Sample
hijack_hl2.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
hijack_hl2.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
hijack_hl2.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
hijack_hl2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
hl2.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
hl2.exe
Resource
win10v2004-20240508-en
General
-
Target
a1a0b248d947896ff554273c8a043667_JaffaCakes118
-
Size
50KB
-
MD5
a1a0b248d947896ff554273c8a043667
-
SHA1
7a2f2ab60ae8fdbe7839917eb6859db8eedec571
-
SHA256
d613d3ff104fb311d8fa2305ffafdeceb03a71b3cf03772597a5970be8721b78
-
SHA512
0eb0ef16e6cfc6cff4ffccac11f73ae161ae747ef01ea35e59fe6f464ec70091ae9c8b13a21fe225a4110f8fd0fe085d8af3cc22284ef5085a9fcd489633e807
-
SSDEEP
768:OMAZpFOWoygH8jDGlXmbaeTioo/Zi6kx1HDJ7WagRtk1i/6aVeJODp+k9zUFniG:OBlRMuDG+7TqBLUJJ7OXkQ/6aMGGiG
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack002/hijack_hl2.dll unpack002/hijack_hl2.exe unpack002/hl2.exe
Files
-
a1a0b248d947896ff554273c8a043667_JaffaCakes118.zip
-
Half-Life.2.NoCDDVD.Patch-iND/hijack-hl2.nfo
-
Half-Life.2.NoCDDVD.Patch-iND/hijack-hl2.rar.rar
-
hijack-hl2.txt
-
hijack_hl2.dll.dll windows:4 windows x86 arch:x86
606ce6552a850ddd8b2dbf74697999d0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
kernel32
AddAtomA
CopyFileA
FindAtomA
FlushInstructionCache
GetAtomNameA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
VirtualProtect
msvcrt
__dllonexit
_errno
abort
fflush
free
malloc
strcmp
strcpy
strrchr
strstr
user32
MessageBoxA
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 144B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
hijack_hl2.exe.exe windows:4 windows x86 arch:x86
d3c227217fbcc6303c3bd4986812c853
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
AdjustTokenPrivileges
GetTokenInformation
LookupPrivilegeValueA
OpenProcessToken
SetEntriesInAclA
SetSecurityInfo
kernel32
AddAtomA
CloseHandle
CreateProcessA
CreateRemoteThread
DuplicateHandle
ExitProcess
FindAtomA
GetAtomNameA
GetCommandLineA
GetCurrentProcess
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
LocalFree
OpenProcess
SetUnhandledExceptionFilter
VirtualAllocEx
VirtualFreeEx
WaitForSingleObject
WriteProcessMemory
lstrlenA
lstrlenW
msvcrt
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_fileno
_iob
_onexit
_setmode
abort
atexit
free
malloc
signal
user32
MessageBoxA
wsprintfW
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 112B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
hl2.exe.exe windows:4 windows x86 arch:x86
3f451688b654bcd8e1315193df963088
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
kernel32
GetStdHandle
CloseHandle
GetProcAddress
LocalFree
FormatMessageA
GetLastError
LoadLibraryA
GetModuleFileNameA
MultiByteToWideChar
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
SetEnvironmentVariableW
TerminateProcess
GetCurrentProcess
SetEnvironmentVariableA
HeapAlloc
WideCharToMultiByte
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapReAlloc
VirtualAlloc
IsBadWritePtr
SetFilePointer
GetCPInfo
CompareStringA
CompareStringW
GetACP
GetOEMCP
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Half-Life.2.NoCDDVD.Patch-iND/hijack-hl2.sfv