Static task
static1
Behavioral task
behavioral1
Sample
nmap-4.01/nmap.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
nmap-4.01/nmap.exe
Resource
win10v2004-20240709-en
General
-
Target
36b8ea430cb8b061f0bc7c115c9005af_JaffaCakes118
-
Size
625KB
-
MD5
36b8ea430cb8b061f0bc7c115c9005af
-
SHA1
51ff60181f9de19125184f18821a4c931c1caf83
-
SHA256
c8c78645ff1fb762bc89502732bb096563028c19d4636c01b2843aac01963f07
-
SHA512
b16019f8827d7a0b4a8167220f97ed31e4deb8ca91937474f1d13d9905c77e746f587eb557f21f0349d7e48fe62332aeb5ccc56e28617c34b345814ec522e047
-
SSDEEP
12288:wuo2VFufKaM8VV2ue8aManNoRkxS+zAObbRaTHWFlWMFtTLMYGaIZ:d1Ls2uxxamRkrAkai7WMzsr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/nmap-4.01/nmap.exe
Files
-
36b8ea430cb8b061f0bc7c115c9005af_JaffaCakes118.zip
-
nmap-4.01/CHANGELOG
-
nmap-4.01/COPYING
-
nmap-4.01/README-WIN32
-
nmap-4.01/nmap-mac-prefixes
-
nmap-4.01/nmap-os-fingerprints
-
nmap-4.01/nmap-protocols
-
nmap-4.01/nmap-rpc
-
nmap-4.01/nmap-service-probes
-
nmap-4.01/nmap-services
-
nmap-4.01/nmap.exe.exe windows:4 windows x86 arch:x86
8d9a6257157844e0005980c97a1bb559
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
closesocket
WSACleanup
WSAStartup
WSASetLastError
ioctlsocket
getsockopt
select
__WSAFDIsSet
recvfrom
recv
sendto
getservbyport
gethostbyaddr
getservbyname
htonl
WSAGetLastError
inet_addr
ntohl
gethostbyname
gethostname
htons
connect
send
setsockopt
bind
socket
ntohs
inet_ntoa
advapi32
RegQueryValueExA
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
kernel32
GetOEMCP
GetACP
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetCPInfo
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
VirtualQuery
GetSystemInfo
VirtualProtect
SetUnhandledExceptionFilter
FlushFileBuffers
SetEnvironmentVariableW
WideCharToMultiByte
CompareStringA
CompareStringW
GetLocaleInfoA
FreeEnvironmentStringsA
FindClose
GetModuleFileNameA
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
HeapFree
GetProcessHeap
FormatMessageA
GetLastError
GetVersion
CloseHandle
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
UnmapViewOfFile
FlushViewOfFile
GetVersionExA
Sleep
SetLastError
LocalAlloc
InterlockedExchange
RaiseException
GetSystemTimeAsFileTime
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentProcess
DuplicateHandle
GetFileType
HeapAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
MultiByteToWideChar
GetCurrentProcessId
GetTimeFormatA
GetDateFormatA
HeapReAlloc
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
WriteFile
GetCommandLineA
GetTimeZoneInformation
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
HeapSize
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetFileAttributesA
SetHandleCount
GetStdHandle
GetStartupInfoA
SetStdHandle
SetEndOfFile
ReadFile
SetFilePointer
GetFullPathNameA
GetCurrentDirectoryA
SetEnvironmentVariableA
Sections
.text Size: 265KB - Virtual size: 265KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
nmap-4.01/nmap.xsl.js .xml polyglot
-
nmap-4.01/nmap_performance.reg