Overview
overview
4Static
static
370632269/B...CP.exe
windows7-x64
70632269/B...CP.exe
windows10-2004-x64
70632269/D...de.rtf
windows7-x64
470632269/D...de.rtf
windows10-2004-x64
170632269/D...IS.vbs
windows7-x64
170632269/D...IS.vbs
windows10-2004-x64
170632269/D...ld.vbs
windows7-x64
170632269/D...ld.vbs
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
70632269/Bin/IPLCP.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
70632269/Bin/IPLCP.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
70632269/Doc/progguide.rtf
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
70632269/Doc/progguide.rtf
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
70632269/Drivers.9X/PCAIPLCE/NDIS.vbs
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
70632269/Drivers.9X/PCAIPLCE/NDIS.vbs
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
70632269/Drivers.9X/PCAIPLCE/build.vbs
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
70632269/Drivers.9X/PCAIPLCE/build.vbs
Resource
win10v2004-20240508-en
General
-
Target
232aaf512ae5e11f8905cb5dba0b0d22_JaffaCakes118
-
Size
217KB
-
MD5
232aaf512ae5e11f8905cb5dba0b0d22
-
SHA1
a9b042fb8b215f09e2131963e3876124136ee6fe
-
SHA256
cf53d085d3b3175b78d93fc15054cbbaf8d097fffd9b93feb1ea4008ca34b42d
-
SHA512
079275dd747ef81e8392348aa4f95410a937558fdbd98266f8ae65d25d4f90348decace25cabd41abd799f0f2b8e15d57df6a0d81e9615b3d17091631fadd3c2
-
SSDEEP
6144:xBAGatAPFM3j8Kq12PtVvuBy8jd6aIuepgxp:xBgAPFWaStxuB1YaIueGp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/70632269/Bin/IPLCP.exe
Files
-
232aaf512ae5e11f8905cb5dba0b0d22_JaffaCakes118.rar
-
70632269/Apps.9X/IPLCP/ChooseAdapterDlg.cpp
-
70632269/Apps.9X/IPLCP/ChooseAdapterDlg.h
-
70632269/Apps.9X/IPLCP/IPLCP.CLW
-
70632269/Apps.9X/IPLCP/IPLCP.DSP
-
70632269/Apps.9X/IPLCP/IPLCP.H
-
70632269/Apps.9X/IPLCP/IPLCP.rc
-
70632269/Apps.9X/IPLCP/IPLCPDlg.cpp
-
70632269/Apps.9X/IPLCP/IPLCPDlg.h
-
70632269/Apps.9X/IPLCP/Iplcp.cpp
-
70632269/Apps.9X/IPLCP/RES/ADAPTER.ICO
-
70632269/Apps.9X/IPLCP/RES/IPLCP.ICO
-
70632269/Apps.9X/IPLCP/RES/IPLCP.RC2
-
70632269/Apps.9X/IPLCP/RESOURCE.H
-
70632269/Apps.9X/IPLCP/StdAfx.cpp
-
70632269/Apps.9X/IPLCP/StdAfx.h
-
70632269/Apps.9X/IPLCP/ZRegInfo.cpp
-
70632269/Apps.9X/IPLCP/ZRegInfo.h
-
70632269/Apps.9X/IPLCP/ZTcpPIM.cpp
-
70632269/Apps.9X/IPLCP/ZTcpPIM.h
-
70632269/Bin/IPLCP.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 844B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.khe Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
70632269/Bin/PCAIPLCE.REG
-
70632269/Bin/PCAIPLCE.VXD
-
70632269/Doc/progguide.doc.rtf .doc
-
70632269/Drivers.9X/PCAIPLCE/FWSVRW9X.DEF
-
70632269/Drivers.9X/PCAIPLCE/FWSVRW9X.REG
-
70632269/Drivers.9X/PCAIPLCE/HOOK.C
-
70632269/Drivers.9X/PCAIPLCE/MAKEFILE
-
70632269/Drivers.9X/PCAIPLCE/MAKEFILE.bak
-
70632269/Drivers.9X/PCAIPLCE/MSTCPH.H
-
70632269/Drivers.9X/PCAIPLCE/MSTCP_P.C
-
70632269/Drivers.9X/PCAIPLCE/MSTCP_W.C
-
70632269/Drivers.9X/PCAIPLCE/NDIS.MK.vbs
-
70632269/Drivers.9X/PCAIPLCE/NDISDEV.ASM
-
70632269/Drivers.9X/PCAIPLCE/NDISHOOK.C
-
70632269/Drivers.9X/PCAIPLCE/NDISHOOK.H
-
70632269/Drivers.9X/PCAIPLCE/PCAIPLCE.C
-
70632269/Drivers.9X/PCAIPLCE/PCAIPLCE.H
-
70632269/Drivers.9X/PCAIPLCE/PCAIPLCE.RC
-
70632269/Drivers.9X/PCAIPLCE/RULEDEF.H
-
70632269/Drivers.9X/PCAIPLCE/UTIL.C
-
70632269/Drivers.9X/PCAIPLCE/UTIL.H
-
70632269/Drivers.9X/PCAIPLCE/VTOOLSD/DEBUG.MAK
-
70632269/Drivers.9X/PCAIPLCE/VTOOLSD/PCAIPLCE.DEF
-
70632269/Drivers.9X/PCAIPLCE/VTOOLSD/PCAIPLCE.VRC
-
70632269/Drivers.9X/PCAIPLCE/VTOOLSD/RELEASE.MAK
-
70632269/Drivers.9X/PCAIPLCE/build.log.vbs
-
70632269/Drivers.9X/PCAIPLCE/build.wrn
-
70632269/Drivers.9X/PCAIPLCE/obj/_objects.mac
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/checked/FWSVRW9X.NMS
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/checked/FWSVRW9X.VXD
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/checked/FWSVRW9X.exp
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/checked/FWSVRW9X.lib
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/checked/FWSVRW9X.map
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/checked/FWSVRW9X.sym
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/checked/hook.obj
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/checked/mstcp_p.obj
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/checked/mstcp_w.obj
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/checked/ndisdev.obj
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/checked/ndishook.obj
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/checked/pcaiplce.obj
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/checked/util.obj
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/free/FWSVRW9X.VXD
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/free/FWSVRW9X.exp
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/free/FWSVRW9X.lib
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/free/FWSVRW9X.map
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/free/FWSVRW9X.sym
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/free/hook.obj
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/free/mstcp_p.obj
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/free/mstcp_w.obj
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/free/ndisdev.obj
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/free/ndishook.obj
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/free/pcaiplce.obj
-
70632269/Drivers.9X/PCAIPLCE/obj/i386/free/util.obj
-
70632269/Drivers.9X/PCAIPLCE/sources
-
70632269/Drivers.9X/PCAIPLCE/vc60.pdb
-
70632269/Include/Iplceapi.h
-
70632269/Include/PCAENET.H
-
70632269/LBLInc/DDKLBLInc.h
-
70632269/LBLInc/IGMP.H
-
70632269/LBLInc/IN.H
-
70632269/LBLInc/IN_SYSTM.H
-
70632269/LBLInc/IP.H
-
70632269/LBLInc/IP_ICMP.H
-
70632269/LBLInc/IP_MROUT.H
-
70632269/LBLInc/TCP.H
-
70632269/LBLInc/UDP.H
-
70632269/LBLInc/ethertype.h
-
70632269/下载说明.htm.html .js polyglot