NvOptimusEnablementCuda
Static task
static1
Behavioral task
behavioral1
Sample
miniZ.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
miniZ.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
miniZ_gui.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
miniZ_gui.exe
Resource
win10v2004-20240709-en
General
-
Target
4e060083718c1cc9c7d5f46136e3014b_JaffaCakes118
-
Size
14.2MB
-
MD5
4e060083718c1cc9c7d5f46136e3014b
-
SHA1
ef382abda7e937e3cc6c271bf0a09717ebac1e76
-
SHA256
371c035f0d274dcc46a61f00d394ec16178e21ea308205966f29e5d6bc40a634
-
SHA512
a43b07c8562de04c829a6aaf2660ee56a8b8332d57889f977c3cca9f9dea686bbe450e4a8568ddc1ffdfaed5e2ad518fa0a5012b95c764bc0939e9c82eb88065
-
SSDEEP
393216:E9OUbrAjA1cfL9jXcx+no0XPGSxG7VKfSM70gKwNf3fRcNFs:E7T1cxjMx+no0U5KfSO0gJ/fRMs
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/miniZ.exe unpack001/miniZ_gui.exe
Files
-
4e060083718c1cc9c7d5f46136e3014b_JaffaCakes118.zip
-
miniZ.exe.exe windows:6 windows x64 arch:x64
4a477f26b8e826f6f7a0882e661dca5d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wsock32
WSACleanup
WSAGetLastError
WSASetLastError
closesocket
gethostname
listen
htonl
bind
accept
gethostbyname
socket
setsockopt
send
recv
htons
connect
WSAStartup
crypt32
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty
advapi32
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
kernel32
ChangeTimerQueueTimer
CreateTimerQueueTimer
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
IsDebuggerPresent
DeleteTimerQueueTimer
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringW
CompareStringW
GetCPInfo
CreateEventW
InitializeCriticalSectionAndSpinCount
DecodePointer
EncodePointer
GetNumaHighestNodeNumber
RtlPcToFileHeader
RegisterWaitForSingleObject
UnregisterWait
ExpandEnvironmentStringsA
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetTickCount
ReleaseSemaphore
GetModuleHandleA
GetProcAddress
CreateEventA
OpenEventA
SetEvent
ResetEvent
GetCurrentThreadId
Sleep
GetCurrentProcessId
WaitForSingleObjectEx
CloseHandle
GetProcessHeap
HeapAlloc
HeapFree
GetLastError
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
LocalFree
FormatMessageA
OpenProcess
GetVersionExA
FreeLibrary
LoadLibraryA
RaiseException
SetUnhandledExceptionFilter
WaitForSingleObject
GetCurrentProcess
CreateThread
GetModuleFileNameW
MultiByteToWideChar
GetEnvironmentVariableA
SetEnvironmentVariableA
SetErrorMode
LoadLibraryExW
SetLastError
GetSystemTime
GetStdHandle
GetFileType
WriteFile
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GlobalMemoryStatus
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
DuplicateHandle
GetCurrentThread
SetThreadPriority
GetThreadPriority
GetThreadContext
SetThreadContext
GetSystemDirectoryA
GetProcessAffinityMask
WaitForMultipleObjects
CreateSemaphoreA
QueryPerformanceFrequency
HeapCreate
HeapDestroy
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SwitchToThread
GetNativeSystemInfo
VirtualAlloc
VirtualFree
VirtualProtect
FreeLibraryAndExitThread
SetThreadAffinityMask
VerSetConditionMask
GetFileAttributesW
GetFullPathNameW
GetSystemDirectoryW
LocalAlloc
VerifyVersionInfoW
GetThreadTimes
GetVersionExW
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
GetExitCodeThread
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
vcruntime140
strstr
__RTDynamicCast
strchr
memcmp
__std_type_info_compare
__C_specific_handler
wcsstr
strrchr
longjmp
wcsrchr
__uncaught_exception
__uncaught_exceptions
__vcrt_InitializeCriticalSectionEx
__intrinsic_setjmp
__std_exception_copy
__current_exception
__std_terminate
_purecall
__processing_throw
__AdjustPointer
memchr
memset
memcpy
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
memmove
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_beginthreadex
_initterm_e
_initterm
_get_initial_narrow_environment
terminate
_set_app_type
_seh_filter_exe
_cexit
exit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
abort
_configure_narrow_argv
_invalid_parameter_noinfo
_errno
system
_endthreadex
perror
raise
_crt_atexit
signal
strerror
_exit
strerror_s
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0
_stricmp
_strnicmp
strncmp
strspn
_strdup
isalpha
__strncnt
isxdigit
strtok
strcspn
islower
_wcsdup
strncpy
_wcsupr
iswprint
_wcsnicmp
tolower
isspace
isdigit
_wcsicmp
toupper
_strupr
strncat_s
isupper
strcmp
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_free_base
_callnewh
_calloc_base
_malloc_base
realloc
free
calloc
api-ms-win-crt-math-l1-1-0
exp
__setusermatherr
ldexp
frexp
powf
log10
sqrt
pow
api-ms-win-crt-stdio-l1-1-0
_fsopen
fgetc
fflush
fputc
__stdio_common_vswprintf
fsetpos
_get_stream_buffer_pointers
putc
__stdio_common_vsprintf_s
ungetc
feof
ferror
fputs
fopen
fclose
fgets
_fileno
fread
fseek
ftell
_setmode
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsscanf
_set_fmode
setvbuf
_wfopen
__stdio_common_vsprintf
fwrite
fgetpos
_fseeki64
__p__commode
api-ms-win-crt-locale-l1-1-0
_unlock_locales
__pctype_func
_configthreadlocale
___lc_locale_name_func
___lc_codepage_func
___mb_cur_max_func
setlocale
localeconv
_lock_locales
___lc_collate_cp_func
api-ms-win-crt-convert-l1-1-0
strtod
strtol
atof
strtof
atoi
strtoul
api-ms-win-crt-time-l1-1-0
_localtime64
_gmtime64
_time64
strftime
_ftime64_s
_Strftime
_Gettnames
api-ms-win-crt-utility-l1-1-0
srand
rand_s
rand
qsort
div
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
_unlock_file
_lock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-multibyte-l1-1-0
_ismbblead
Exports
Exports
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 887KB - Virtual size: 886KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 168KB - Virtual size: 499KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ctors Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dtors Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nv_fatb Size: 60.2MB - Virtual size: 60.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nvFatBi Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
miniZ.exe.sha256sum
-
miniZ_gui.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 377KB - Virtual size: 377KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
miniZ_gui.exe.sha256sum