Static task
static1
Behavioral task
behavioral1
Sample
EUPL-EN.pdf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
EUPL-EN.pdf
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
tftpd32.chm
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
tftpd32.chm
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
tftpd32.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
tftpd32.exe
Resource
win10v2004-20240709-en
General
-
Target
4d833488c4ad0ef8ffa1f1ec922c8a74_JaffaCakes118
-
Size
479KB
-
MD5
4d833488c4ad0ef8ffa1f1ec922c8a74
-
SHA1
5c1c8e61f5645bf780c42e3426205807ffcb9ee9
-
SHA256
b6ab8433a201cf4bc8ea758ec59eceecea8ad82f7bbf232f3fd0374e7f1fd131
-
SHA512
e2417d92f0b95c087682838320e691bb585c5a14736454e4d2ae538b55596fd78d7fd5a63929636c32a16c4bfbca87de594374a7206698f5e2dfa04d294750ca
-
SSDEEP
12288:0WbD2Le27Xg/Th/PTm5aG9soXVsOpJuSnCQQJjbHJ7:0Myd7Xg/TZTm5rVsyJbnCzJjbp7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/tftpd32.exe
Files
-
4d833488c4ad0ef8ffa1f1ec922c8a74_JaffaCakes118.zip
-
EUPL-EN.pdf.pdf
-
tftpd32.chm.chm
-
tftpd32.exe.exe windows:5 windows x86 arch:x86
8fb0eabc6469245624f56e58ccb146f3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetCursorPos
LoadMenuA
GetWindowLongA
GetDlgItem
GetDlgItemTextA
SetDlgItemInt
GetDlgItemInt
PostMessageA
SetWindowPos
GetClientRect
GetWindowRect
GetDialogBaseUnits
SystemParametersInfoA
UnhookWindowsHookEx
SetWindowsHookExA
DialogBoxParamA
CreateWindowExA
RegisterClassA
GetClassInfoA
GetParent
SetClipboardData
EmptyClipboard
OpenClipboard
GetFocus
GetSubMenu
ShowWindow
SetWindowTextA
DestroyWindow
AppendMenuA
GetSystemMenu
IsWindowVisible
GetTopWindow
CreateDialogParamA
ReleaseDC
GetDC
EnableWindow
SendDlgItemMessageA
DefWindowProcA
SetWindowLongA
SetClassLongA
LoadIconA
TrackPopupMenu
DestroyMenu
SendMessageA
wsprintfA
EndDialog
CloseClipboard
SetDlgItemTextA
MessageBeep
CallWindowProcA
wvsprintfA
GetWindowTextA
MapDialogRect
MoveWindow
InvalidateRect
UnregisterClassA
FindWindowA
IsWindow
MessageBoxA
LoadCursorA
SetCursor
GetWindow
DestroyIcon
KillTimer
CheckMenuItem
SetTimer
GetSystemMetrics
SetForegroundWindow
shell32
SHGetPathFromIDListA
ShellExecuteA
DragFinish
DragQueryFileA
DragAcceptFiles
Shell_NotifyIconA
SHBrowseForFolderA
gdi32
LPtoDP
GetTextExtentPoint32A
comdlg32
GetOpenFileNameA
advapi32
RegQueryValueExA
RegCloseKey
RegSetValueExA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
ws2_32
inet_ntoa
inet_addr
htonl
ntohl
htons
recvfrom
closesocket
sendto
socket
getservbyname
gethostname
listen
WSASetLastError
setsockopt
send
freeaddrinfo
getaddrinfo
WSAAsyncSelect
ntohs
gethostbyname
WSACleanup
WSAStartup
bind
WSAGetLastError
connect
recv
WSACloseEvent
WSAEventSelect
WSACreateEvent
select
getsockname
accept
comctl32
InitCommonControlsEx
iphlpapi
SendARP
kernel32
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
MultiByteToWideChar
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
LoadLibraryW
GetTimeZoneInformation
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
ExitProcess
GetProcAddress
GetModuleHandleW
HeapCreate
VirtualAlloc
VirtualFree
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
LoadLibraryA
SetStdHandle
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
GetCommandLineA
GetDriveTypeA
GetModuleFileNameW
GetStdHandle
GetFileType
WriteConsoleW
HeapReAlloc
ResumeThread
ExitThread
HeapFree
HeapAlloc
HeapSize
SetEndOfFile
GetSystemTimeAsFileTime
GlobalAlloc
GlobalLock
GlobalUnlock
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatA
FindNextFileA
FindClose
OutputDebugStringA
FormatMessageA
LocalFree
WritePrivateProfileStringA
GetPrivateProfileStringA
SetThreadPriority
SetLastError
GetProcessHeap
CompareStringA
GetCurrentProcess
CloseHandle
FlushFileBuffers
WriteFile
SetFilePointer
Sleep
CreateFileA
GetLocalTime
lstrlenA
GetFileSize
GetTickCount
GetCurrentThreadId
lstrcmpA
lstrcpyA
GetLastError
lstrcatA
lstrcpynA
SetEnvironmentVariableA
GetEnvironmentVariableA
SetProcessWorkingSetSize
CompareStringW
ReleaseMutex
CreateMutexA
GetFullPathNameA
CreateProcessA
WaitForSingleObject
lstrcmpiA
ResetEvent
GetModuleFileNameA
GetCurrentDirectoryA
GetSystemTime
SetEvent
CreateEventA
WaitForMultipleObjects
DeleteFileA
ReleaseSemaphore
SetCurrentDirectoryA
GetFileAttributesA
CreateSemaphoreA
ReadFile
CreateThread
Sections
.text Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
tftpd32.ini