Static task
static1
Behavioral task
behavioral1
Sample
xp_700f4.exe
Resource
win7-20240729-en
General
-
Target
ae6975b44188f7070202f4894ab10a47_JaffaCakes118
-
Size
3.8MB
-
MD5
ae6975b44188f7070202f4894ab10a47
-
SHA1
5822cd997a43c1243f137a50a8847725ee5e05e2
-
SHA256
b8f09a5909d5108b3845234d5b99245bd17c22c42f53e4372daa86ee4c73fafd
-
SHA512
f7dec9f9a88dda1d41dda66249361c222c34e5dfa74823ffda86489c51229fe0490c9ae61c2da353d60938b2863682b3c8a5c2829a7554c3c4a593a3f282baf0
-
SSDEEP
98304:F7mYpJB8j8zoM1oxQz8BJRmZCbYS5jDczfAoGnHD4Eum:F7vPB82oMWxJRmZCbn5nMfzK07m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/xp_700f4.exe
Files
-
ae6975b44188f7070202f4894ab10a47_JaffaCakes118.7z
-
xp_700f4.exe.exe windows:4 windows x86 arch:x86
ce67518019e9e894c666acdb0bed86e2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpynA
GetProcessHeap
CreateEventA
GetFileType
LocalFree
RtlUnwind
GetModuleHandleA
HeapReAlloc
VirtualAlloc
FindResourceW
IsBadReadPtr
GetExitCodeThread
FreeEnvironmentStringsW
VirtualProtect
GetCommandLineW
GetTempPathA
GlobalAlloc
OpenMutexA
ReadFile
GetCurrentDirectoryW
WritePrivateProfileSectionA
GetModuleHandleW
GetLocalTime
Sleep
IsBadWritePtr
GetFileSize
GetConsoleMode
TlsAlloc
CompareStringW
GetFileAttributesA
SetThreadPriority
ResumeThread
lstrcpyA
QueryPerformanceCounter
LCMapStringA
HeapSize
ReleaseMutex
CreateProcessA
SetFileAttributesW
WaitForSingleObject
FindResourceA
ExitProcess
GetFileAttributesW
DeleteFileA
lstrlenA
OpenEventA
CreateFileMappingA
GetCurrentThreadId
GetEnvironmentStringsW
LoadLibraryExA
GetVersion
Sections
.text Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.textbss Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.textbss Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.textbss Size: 7KB - Virtual size: 5.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.textbss Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 3KB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ