Static task
static1
Behavioral task
behavioral1
Sample
HOD-ms04011-lsasrv-expl.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
HOD-ms04011-lsasrv-expl.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
说&明.htm
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
说&明.htm
Resource
win10v2004-20240708-en
General
-
Target
30c716a4c1e9c0aec3a273e31bb26c48_JaffaCakes118
-
Size
59KB
-
MD5
30c716a4c1e9c0aec3a273e31bb26c48
-
SHA1
ca3ea24bc69f6f48c1a2473b0e3f5e034ede9de4
-
SHA256
289c4df99b47a31766541ce566fd5c68fde6ee3f9830af8061406dbe2c196922
-
SHA512
75f477feaac27413a3ef8c1e147aa6f1d5e985886e0433cfa846895c5fd01b94ac12d588571080956900ec8bdf37a6b9cba58cf6a4daa8a793f0e41b1e1b9227
-
SSDEEP
1536:Bpj8qJWkVEIz6HmB7sSEJuJvOQi1MBhClkWEK/b:LlJdEIQyvBOQi1KhYNj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/HOD-ms04011-lsasrv-expl.exe
Files
-
30c716a4c1e9c0aec3a273e31bb26c48_JaffaCakes118.rar
-
HOD-ms04011-lsasrv-expl.c
-
HOD-ms04011-lsasrv-expl.exe.exe windows:4 windows x86 arch:x86
7270e5b90d142e79ea6fad2e6f36ce6e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htons
inet_addr
WSAStartup
gethostbyname
socket
connect
send
recv
kernel32
FreeEnvironmentStringsW
FreeEnvironmentStringsA
CloseHandle
LCMapStringW
LCMapStringA
SetStdHandle
FlushFileBuffers
GetOEMCP
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
IsBadWritePtr
IsBadReadPtr
HeapValidate
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
GetLastError
UnhandledExceptionFilter
GetACP
VirtualFree
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
SetConsoleCtrlHandler
RtlUnwind
HeapAlloc
HeapReAlloc
VirtualAlloc
SetFilePointer
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
Sections
.text Size: 128KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
read it.txt
-
说&明.htm.html
-
说&明.txt