c:\Users\michi\Desktop\Rootkit\Rootkit.C\release\Rootkit.C.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0cf3c2aee431475d75bc79d5ea323730_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0cf3c2aee431475d75bc79d5ea323730_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0cf3c2aee431475d75bc79d5ea323730_JaffaCakes118
-
Size
104KB
-
MD5
0cf3c2aee431475d75bc79d5ea323730
-
SHA1
313f4eb1ea98af681ada997d9f46c9ef41f6f31a
-
SHA256
2387103da53a8e52093bac68243569c265e23129db6d874ee29c24c9d229698d
-
SHA512
5f8b76dc9fa3d84a577499dc2e64e31b4c9460a6bc3f82be0c7efc652717135e1144584f207259e3ab609c902d28d276ff8e4a8c113e9e42826cf162bbd5eb5e
-
SSDEEP
1536:ngTJCNMiJ0dxUEy5beFI5sxyCNYwUch0IdTh8evcmmt0DH:n2JhCgPCR41hWevcmmt0DH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0cf3c2aee431475d75bc79d5ea323730_JaffaCakes118
Files
-
0cf3c2aee431475d75bc79d5ea323730_JaffaCakes118.exe windows:4 windows x86 arch:x86
135ac2edf354e1799533690f7a349455
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
closesocket
listen
accept
htonl
htons
shutdown
recv
bind
socket
WSAStartup
send
kernel32
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
CreateFileA
GetCurrentProcess
GetModuleFileNameA
OpenProcess
Process32First
LoadLibraryExA
WaitForSingleObject
CreateMutexA
Sleep
CreateToolhelp32Snapshot
GetProcAddress
CloseHandle
CopyFileA
VirtualAllocEx
GetTempPathA
GetTickCount
WriteProcessMemory
LoadLibraryA
DeleteFileA
CreateRemoteThread
Process32Next
TerminateProcess
GetWindowsDirectoryA
SetErrorMode
FreeLibrary
GetSystemDirectoryA
GetLocaleInfoA
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetLastError
GetModuleHandleA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ReadFile
MultiByteToWideChar
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentProcessId
HeapFree
CreateProcessA
DuplicateHandle
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
ResumeThread
HeapReAlloc
GetSystemTimeAsFileTime
ExitProcess
MoveFileA
GetCommandLineA
GetVersionExA
GetProcessHeap
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetFileAttributesA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
CreatePipe
GetExitCodeProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
WriteFile
HeapSize
InitializeCriticalSection
RaiseException
SetStdHandle
SetFilePointer
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
shlwapi
PathFindFileNameA
advapi32
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA
user32
ShowWindow
GetWindowThreadProcessId
PostMessageA
EnumWindows
GetForegroundWindow
FindWindowA
MessageBoxA
shell32
ShellExecuteA
Sections
.text Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ