Static task
static1
Behavioral task
behavioral1
Sample
6344532/Control.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6344532/Control.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
6344532/Control.html
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
6344532/Control.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
6344532/FOLDER.js
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
6344532/FOLDER.js
Resource
win10v2004-20240802-en
General
-
Target
a532431d9472335acd418dc8b33b5353_JaffaCakes118
-
Size
110KB
-
MD5
a532431d9472335acd418dc8b33b5353
-
SHA1
a9926f85ceb21ad8efad25edfdbded1eb5a12dec
-
SHA256
e518317b7c15d72dbe7e040747ef910b29300f807450189890716029b60755ce
-
SHA512
7d1fde073181d4c346789acf36a9f97044967920b395f5ca1a60e27520a0d6b2c116f87c865cd60185c024998adc116870615cbe3c0ae1cadf1b2821e357ce24
-
SSDEEP
1536:XLtfIK+2Wb2BeQxL0A9u6XoBdH0PUNx3eqhkTJvTBOnPE9Xlqjj8vNHS932CSeWl:NIK1WqBRHwxx9MOns5l88vgoCVnEADtK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/6344532/Control.exe
Files
-
a532431d9472335acd418dc8b33b5353_JaffaCakes118.rar
-
6344532/CONTROL.ICO
-
6344532/Control.dsp
-
6344532/Control.dsw
-
6344532/Control.exe.exe windows:4 windows x86 arch:x86
8b0c00bf7b432775d27a4656192c4641
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
WriteFile
InterlockedDecrement
GetStdHandle
SetStdHandle
SetFilePointer
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
HeapReAlloc
VirtualAlloc
HeapAlloc
GetOEMCP
GetACP
GetCPInfo
HeapValidate
IsBadReadPtr
IsBadWritePtr
SetConsoleCtrlHandler
GetLastError
RtlUnwind
VirtualFree
HeapFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
CloseHandle
FlushFileBuffers
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetCurrentProcess
ExitProcess
DebugBreak
FreeEnvironmentStringsA
LoadLibraryA
FreeEnvironmentStringsW
OutputDebugStringA
GetProcAddress
InterlockedIncrement
GetModuleFileNameA
TerminateProcess
UnhandledExceptionFilter
user32
MessageBoxA
DispatchMessageA
TranslateMessage
GetMessageA
SetWindowsHookExA
UpdateWindow
ShowWindow
CallNextHookEx
EndDialog
SetForegroundWindow
SetCapture
GetCursorPos
CreatePopupMenu
AppendMenuA
TrackPopupMenu
PostMessageA
DestroyMenu
ReleaseCapture
ExitWindowsEx
GetWindowLongA
DialogBoxParamA
PostQuitMessage
DefWindowProcA
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
FindWindowA
gdi32
GetStockObject
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
shell32
Shell_NotifyIconA
winmm
mciSendStringA
Sections
.text Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
6344532/Control.ncb
-
6344532/Control.opt
-
6344532/Control.plg.html
-
6344532/FOLDER.HTT.js
-
6344532/Icondemo.aps
-
6344532/Icondemo.h
-
6344532/Icondemo.rc
-
6344532/control.c
-
6344532/desktop.ini
-
6344532/resource.h
-
6344532/下载说明.htm.html .js polyglot