Static task
static1
Behavioral task
behavioral1
Sample
codwawSp.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
codwawSp.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
codwawSp.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
codwawSp.exe
Resource
win10v2004-20240709-en
General
-
Target
40163a1cefdd2fbc1ae80763e4668b75_JaffaCakes118
-
Size
120KB
-
MD5
40163a1cefdd2fbc1ae80763e4668b75
-
SHA1
af72371beb50ac52f94943749e4052ee325132ba
-
SHA256
d7d9f233556ce2d5ce48433021a44551dbd161b02b532629268772dc33bfe516
-
SHA512
f7a6b5239efa4d3bbeb149146ee78f0e8dbc704889594fbd609584ea16c5b23c765aa8a03305a7bd84474f1884fcdba5d3c3e1698ab7d2fa6be4c667ac0bd584
-
SSDEEP
3072:JAK6JhcTUEalIvBnT6eWO4QzGdcC2wkXUzbztqJ4:JAKGiTUEalIvBnvWWR1eRr
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/codwawSp.dll unpack001/codwawSp.exe
Files
-
40163a1cefdd2fbc1ae80763e4668b75_JaffaCakes118.rar
-
codwawSp.dll.dll windows:4 windows x86 arch:x86
6c949420106459dfd3dbb2c101238f4c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleFileNameA
CreateThread
DisableThreadLibraryCalls
WriteProcessMemory
GetCurrentProcess
VirtualQuery
LoadLibraryA
GetProcAddress
FreeLibrary
FlushInstructionCache
VirtualProtect
SetLastError
GetModuleHandleA
user32
GetAsyncKeyState
winmm
timeGetTime
msvcrt
_vsnprintf
vsprintf
_CItan
_CIsqrt
_CIcos
_CIsin
_CIatan2
fprintf
_ftol
atof
strrchr
sprintf
strncpy
??3@YAXPAX@Z
??2@YAPAXI@Z
memset
strcat
strcpy
_except_handler3
strcmp
memcmp
memcpy
free
_initterm
malloc
_adjust_fdiv
__dllonexit
_onexit
fopen
fwrite
fclose
fgets
Sections
.text Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
codwawSp.exe.exe windows:4 windows x86 arch:x86
7aa65e6252fc1575a782c5f244c00295
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReadProcessMemory
GlobalAlloc
OpenProcess
CloseHandle
SetThreadContext
SuspendThread
Sleep
ResumeThread
WriteProcessMemory
VirtualProtectEx
GetThreadContext
GetExitCodeThread
WaitForSingleObject
CreateRemoteThread
GlobalFree
FindFirstFileA
GetWindowsDirectoryA
SetFileAttributesA
TerminateProcess
CreateProcessA
SetCurrentDirectoryA
DeleteFileA
GetModuleFileNameA
LoadLibraryA
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
CreateFileA
GetModuleHandleA
GetProcAddress
ExitProcess
GetVersion
GetStartupInfoA
GetCommandLineA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapFree
GetLastError
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
GetStringTypeA
GetStringTypeW
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
ReadFile
SetEndOfFile
user32
MessageBoxA
comdlg32
GetOpenFileNameA
GetSaveFileNameA
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
Sections
.text Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ