Static task
static1
Behavioral task
behavioral1
Sample
w7ddpatcher.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
w7ddpatcher.exe
Resource
win10v2004-20240709-en
General
-
Target
6f12e1c4508a4899b8b4e9980f9423d2_JaffaCakes118
-
Size
24KB
-
MD5
6f12e1c4508a4899b8b4e9980f9423d2
-
SHA1
f940dd08a1bc85206d0815950f4960bd4d4709f2
-
SHA256
7b776dec0bcb388773f2cd3844eab302a99cac2bdb545650d095fe27480127f4
-
SHA512
497252cd8ccc893f9a59b174a91eb20743eb6afc2a9ac096d7ec75fc6efe3bc5cbad6a2488eb6f6d206d0ee24b66ea1e3635eb7f858c4c57fac8ac1611fdd4dd
-
SSDEEP
384:fN4ANaN7yTwfFeaTLNilLUlDNhY5uq16YyF9HCaJDJWXBbFn:fuSaNkXaTRWLUlDNhQfIYyFBNJWXBbFn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/w7ddpatcher.exe
Files
-
6f12e1c4508a4899b8b4e9980f9423d2_JaffaCakes118.zip
-
main.c
-
w7ddpatcher.exe.exe windows:4 windows x86 arch:x86
42375381e3a3bed6d7a1ba8b250fa9e9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetProcAddress
GetCurrentProcess
CreateToolhelp32Snapshot
Process32First
CloseHandle
Process32Next
OpenProcess
WaitForSingleObject
Sleep
TerminateProcess
CreateProcessA
CreateThread
GetStartupInfoA
RtlUnwind
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
HeapValidate
ExitProcess
GetSystemTimeAsFileTime
GetFileType
GetStdHandle
DuplicateHandle
SetHandleCount
GetCommandLineA
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetConsoleCtrlHandler
MultiByteToWideChar
VirtualAlloc
VirtualQuery
WideCharToMultiByte
user32
GetForegroundWindow
GetWindowThreadProcessId
GetClassNameA
GetClassInfoExA
LoadIconA
RegisterClassExA
DialogBoxParamA
EndDialog
GetDlgItem
SendMessageA
comctl32
InitCommonControlsEx
comdlg32
GetOpenFileNameA
advapi32
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
shlwapi
PathFindFileNameA
Sections
.text Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ