SetMasterDatabase
Static task
static1
Behavioral task
behavioral1
Sample
globalops.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
globalops.exe
Resource
win10v2004-20240802-en
General
-
Target
ce6bfb3a0a214c0f8c47faf2b0518efb_JaffaCakes118
-
Size
600KB
-
MD5
ce6bfb3a0a214c0f8c47faf2b0518efb
-
SHA1
17ac111b0d276db0461ca2e69b1f22b9df563a5a
-
SHA256
09c2d276bf175772ffc5ed98fe0c6e71f1833a0a7f1f81577044b1906bfd8ff6
-
SHA512
dcfe8874cd922801bf73e53fc1d2880bf711f5b111fbc9c2d75659dbc52c71ccbba5d94fe06d8f6e51199331c990d807a963d2668d13b3573d7db61509d9ea4d
-
SSDEEP
12288:sq/V0blW3T4rClGbayhftOJTA9aUX2sWzeKyBSsprhBAtSD7o1Do/:s/CMe8eyaJTA99ZAsFvAtSD8W/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/globalops.exe
Files
-
ce6bfb3a0a214c0f8c47faf2b0518efb_JaffaCakes118.zip
-
JontMaster.nfo
-
globalops.exe.exe windows:4 windows x86 arch:x86
3920e583000b10a14a1fbba8c7f58f75
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ddraw
DirectDrawCreateEx
winmm
timeGetTime
dinput8
DirectInput8Create
kernel32
HeapCompact
DeleteCriticalSection
DebugBreak
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
Sleep
GetTempFileNameA
CreateEventA
MultiByteToWideChar
InterlockedDecrement
GetVersionExA
GetTempPathA
GetTickCount
PulseEvent
SetEvent
ResetEvent
QueryPerformanceFrequency
InitializeCriticalSection
ResumeThread
SetThreadPriority
GetCurrentThreadId
SuspendThread
ExitThread
TerminateThread
lstrcatA
GetCurrentDirectoryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetUserDefaultLangID
SetFilePointer
CreateFileA
ReadFile
WriteFile
FormatMessageA
LocalFree
GetProcAddress
QueryPerformanceCounter
SetCurrentDirectoryA
OutputDebugStringA
CreateMutexA
CreateProcessA
OpenFile
_lclose
SetPriorityClass
WaitForSingleObject
GetCurrentProcess
LoadLibraryA
CloseHandle
FreeLibrary
WaitForMultipleObjects
GetLastError
lstrcpyA
InterlockedIncrement
IsBadReadPtr
GetStringTypeA
GetEnvironmentStringsW
HeapAlloc
HeapFree
GetFullPathNameA
TerminateProcess
FindFirstFileA
ExitProcess
FindClose
FileTimeToSystemTime
FindNextFileA
CreateThread
TlsSetValue
FileTimeToLocalFileTime
GetTimeZoneInformation
GetSystemTime
WideCharToMultiByte
GetModuleHandleA
GetStartupInfoA
GetLocalTime
GetVersion
RtlUnwind
GetCommandLineA
TlsAlloc
GetDriveTypeA
TlsGetValue
SetLastError
HeapCreate
HeapDestroy
VirtualFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
IsBadCodePtr
SetUnhandledExceptionFilter
SetStdHandle
GetStringTypeW
VirtualAlloc
UnhandledExceptionFilter
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetFileType
FlushFileBuffers
RaiseException
GetStdHandle
SetHandleCount
HeapSize
IsBadWritePtr
HeapReAlloc
user32
AdjustWindowRect
SetWindowPos
SetWindowLongA
DestroyWindow
MessageBoxA
GetClassLongA
PeekMessageA
DispatchMessageA
TranslateMessage
ShowWindow
SetCursorPos
UpdateWindow
CreateWindowExA
SetCursor
LoadCursorA
RegisterClassA
GetWindowRect
GetDesktopWindow
IsIconic
LoadIconA
DefWindowProcA
LoadStringA
EndPaint
BeginPaint
GetKeyboardState
PostQuitMessage
SetFocus
ToAscii
ClipCursor
ShowCursor
GetAsyncKeyState
LoadImageA
GetCursorPos
gdi32
SetBkColor
SelectObject
CreateCompatibleDC
SetTextColor
DeleteObject
SetTextCharacterExtra
CreateFontA
GetTextExtentPoint32A
GetTextExtentExPointA
GetTextCharacterExtra
SetTextAlign
Rectangle
TextOutA
CreateDIBSection
DeleteDC
GetTextAlign
SetBkMode
GetStockObject
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
ole32
CoCreateInstance
CoInitialize
CoUninitialize
mss32
_AIL_digital_handle_release@4
_AIL_end_3D_sample@4
_AIL_set_3D_room_type@8
_AIL_set_stream_user_data@12
_AIL_digital_master_volume@4
_AIL_set_digital_master_volume@8
_AIL_digital_handle_reacquire@4
_AIL_sample_user_data@8
_AIL_3D_room_type@4
_AIL_release_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_enumerate_3D_providers@12
_AIL_close_3D_listener@4
_AIL_close_3D_provider@4
_AIL_waveOutClose@4
_AIL_shutdown@0
_AIL_waveOutOpen@16
_AIL_open_3D_provider@4
_AIL_3D_provider_attribute@12
_AIL_get_preference@4
_AIL_open_3D_listener@4
_AIL_set_3D_orientation@28
_AIL_set_preference@8
_AIL_startup@0
_AIL_release_3D_sample_handle@4
_AIL_set_3D_sample_occlusion@8
_AIL_3D_sample_obstruction@4
_AIL_set_3D_sample_obstruction@8
_AIL_3D_velocity@16
_AIL_sample_pan@4
_AIL_stream_pan@4
_AIL_sample_volume@4
_AIL_stream_volume@4
_AIL_3D_orientation@28
_AIL_set_sample_loop_block@12
_AIL_set_sample_loop_count@8
_AIL_set_3D_sample_loop_block@12
_AIL_set_3D_sample_loop_count@8
_AIL_set_stream_loop_count@8
_AIL_start_stream@4
_AIL_set_stream_ms_position@8
_AIL_pause_stream@8
_AIL_start_3D_sample@4
_AIL_set_3D_sample_offset@8
_AIL_resume_3D_sample@4
_AIL_set_sample_ms_position@8
_AIL_resume_sample@4
_AIL_allocate_sample_handle@4
_AIL_set_stream_playback_rate@8
_AIL_3D_user_data@8
_AIL_set_3D_sample_info@8
_AIL_set_3D_sample_playback_rate@8
_AIL_set_3D_user_data@12
_AIL_set_3D_sample_distances@12
_AIL_set_3D_sample_volume@8
_AIL_3D_position@16
_AIL_set_3D_position@16
_AIL_set_3D_velocity_vector@16
_AIL_set_3D_sample_preference@12
_AIL_init_sample@4
_AIL_set_sample_type@12
_AIL_set_sample_reverb@16
_AIL_set_sample_volume@8
_AIL_set_sample_file@12
_AIL_set_sample_address@12
_AIL_set_sample_playback_rate@8
_AIL_set_sample_pan@8
_AIL_ms_count@0
_AIL_stop_sample@4
_AIL_3D_sample_status@4
_AIL_stop_3D_sample@4
_AIL_close_stream@4
_AIL_mem_alloc_lock@4
_AIL_lock@0
_AIL_decompress_ADPCM@12
_AIL_unlock@0
_AIL_decompress_ASI@24
_AIL_last_error@0
_AIL_mem_free_lock@4
_AIL_3D_sample_occlusion@4
_AIL_set_sample_user_data@12
_AIL_set_stream_volume@8
_AIL_set_stream_pan@8
_AIL_open_stream@12
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
wsock32
WSAGetLastError
gethostname
socket
getsockname
ntohs
setsockopt
sendto
WSACleanup
bind
inet_ntoa
closesocket
htons
htonl
gethostbyname
ntohl
ioctlsocket
recvfrom
select
WSAStartup
d3d8
Direct3DCreate8
Exports
Exports
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 618KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.exc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ