Static task
static1
Behavioral task
behavioral1
Sample
src/MAKELIB.bat
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
src/MAKELIB.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
test/test.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
test/test.exe
Resource
win10v2004-20240802-en
General
-
Target
ae4d3e4081b67680aaafc5f6ce077026_JaffaCakes118
-
Size
28KB
-
MD5
ae4d3e4081b67680aaafc5f6ce077026
-
SHA1
54d6d3fbd81c709061b86f307e247d73f977edc3
-
SHA256
3a1e3ced3e1fc19b40bfc82fdb5dc06a2b2c1daab81d8ec2294b01f972d45e60
-
SHA512
50c1d14dfad80e380ccd3b6938978a9076635c692512e63f4dfad78310a3069daf35da4eaff5ea38914a2368b2e82121b6910233e67c2ab12bdf57f2f0f6c530
-
SSDEEP
768:+m0VIpEDcC/TCbDLEvvvkLcjKIRXys0vtO8f5+X:+0YlujEvvsSKhvtOS4X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/test/test.EXE
Files
-
ae4d3e4081b67680aaafc5f6ce077026_JaffaCakes118.zip
-
obj/phide.OBJ
-
obj/phide.ash
-
src/MAKEFILE
-
src/MAKELIB.BAT
-
src/incs/CATCHY32.INC
-
src/incs/MZ.INC
-
src/incs/PE.INC
-
src/incs/internal.ash
-
src/incs/optable.inc
-
src/incs/phide.ash
-
src/phide.inc
-
test/MAKEFILE
-
test/phide.OBJ
-
test/phide.ash
-
test/test.EXE.exe windows:1 windows x86 arch:x86
5ccf02cc846e03199849e329d0502404
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
VirtualProtect
VirtualFree
lstrcmpiA
GetStdHandle
VirtualLock
WriteConsoleA
Beep
CloseHandle
ExitProcess
GetCurrentProcessId
GetProcAddress
VirtualUnlock
GetSystemInfo
GetVersionExA
LoadLibraryExA
LocalFree
Sleep
VirtualAlloc
user32
FindWindowA
wsprintfA
GetWindowThreadProcessId
ntdll
NtUnmapViewOfSection
NtQuerySystemInformation
NtOpenSection
NtMapViewOfSection
advapi32
SetSecurityInfo
SetEntriesInAclW
GetSecurityInfo
Sections
CODE Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
test/test.asm