Static task
static1
Behavioral task
behavioral1
Sample
CoD4 hook by tributoo2 v1/Loader.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
CoD4 hook by tributoo2 v1/Loader.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
CoD4 hook by tributoo2 v1/cod4hook.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
CoD4 hook by tributoo2 v1/cod4hook.dll
Resource
win10v2004-20240802-en
General
-
Target
d04529915444f4a6e488fa9a7523d539_JaffaCakes118
-
Size
271KB
-
MD5
d04529915444f4a6e488fa9a7523d539
-
SHA1
7f1887f8a7e5c2be559b8ec2c04eeb4694d7249a
-
SHA256
7c62c0490881c9cf5dcf1c72b815af3d4e66ea9aa169e68c659c2c24d6c396b7
-
SHA512
c127218de09ae5c2a62efbbf8a2fa2a9b3a2d11ee2b106fdaac48e1650ce6dab4259f225ea0408282c6356abf3536ab9f60378f934b8ed02651dc54881fbab0c
-
SSDEEP
6144:EGcK+rl5tGbeP4cpkBp0rVTNwbBAz4RYTw3J0s9jZNJMXa7:kk6Qp0rVTN4yzHTuiwZN17
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/CoD4 hook by tributoo2 v1/Loader.exe unpack001/CoD4 hook by tributoo2 v1/cod4hook.dll
Files
-
d04529915444f4a6e488fa9a7523d539_JaffaCakes118.rar
-
CoD4 hook by tributoo2 v1/Loader.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 352KB - Virtual size: 352KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 159KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
CoD4 hook by tributoo2 v1/Readme.txt
-
CoD4 hook by tributoo2 v1/cod4hook.dll.dll windows:4 windows x86 arch:x86
4ac13e21bbac22a35bdce8ce0721e9c1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
LoadLibraryA
GetModuleFileNameA
DisableThreadLibraryCalls
VirtualProtect
CreateFileA
InterlockedExchange
RtlUnwind
IsBadWritePtr
IsBadReadPtr
HeapValidate
RaiseException
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
GetModuleHandleA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
FatalAppExitA
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetFilePointer
FlushFileBuffers
CloseHandle
SetUnhandledExceptionFilter
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetConsoleCtrlHandler
IsBadCodePtr
UnhandledExceptionFilter
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
SetStdHandle
ReadFile
GetCPInfo
GetACP
GetOEMCP
Sleep
LCMapStringA
LCMapStringW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
user32
GetAsyncKeyState
Sections
.text Size: 484KB - Virtual size: 481KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ