c:\Users\michi\Desktop\Rootkit\Rootkit.C\release\Rootkit.C.pdb
Static task
static1
Behavioral task
behavioral1
Sample
db4ee770e710bc0aebe81b137a902809_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
db4ee770e710bc0aebe81b137a902809_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
db4ee770e710bc0aebe81b137a902809_JaffaCakes118
-
Size
104KB
-
MD5
db4ee770e710bc0aebe81b137a902809
-
SHA1
7c8b1e2b85ffc873ff8c48ae4649660190055d92
-
SHA256
21dfa2399bebd9f3b4b827ecbfb2e55a37d7e037694bf4bf3769395273d10b7f
-
SHA512
54593b4f9452c0ad6a9c343a0425509edd95b0f31f9b1f4c8fee5f7762e7cfa70c49a6b2ca101d700bd44d7734009d9ecad9404d814b303eb7d015d8c3d77021
-
SSDEEP
1536:ngTJCNMiJ0dxUEy5beFI5sxyCNYwUch0IdTh8evcmmt0Db:n2JhCgPCR41hWevcmmt0Db
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db4ee770e710bc0aebe81b137a902809_JaffaCakes118
Files
-
db4ee770e710bc0aebe81b137a902809_JaffaCakes118.exe windows:4 windows x86 arch:x86
135ac2edf354e1799533690f7a349455
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
closesocket
listen
accept
htonl
htons
shutdown
recv
bind
socket
WSAStartup
send
kernel32
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
CreateFileA
GetCurrentProcess
GetModuleFileNameA
OpenProcess
Process32First
LoadLibraryExA
WaitForSingleObject
CreateMutexA
Sleep
CreateToolhelp32Snapshot
GetProcAddress
CloseHandle
CopyFileA
VirtualAllocEx
GetTempPathA
GetTickCount
WriteProcessMemory
LoadLibraryA
DeleteFileA
CreateRemoteThread
Process32Next
TerminateProcess
GetWindowsDirectoryA
SetErrorMode
FreeLibrary
GetSystemDirectoryA
GetLocaleInfoA
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetLastError
GetModuleHandleA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ReadFile
MultiByteToWideChar
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentProcessId
HeapFree
CreateProcessA
DuplicateHandle
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
ResumeThread
HeapReAlloc
GetSystemTimeAsFileTime
ExitProcess
MoveFileA
GetCommandLineA
GetVersionExA
GetProcessHeap
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetFileAttributesA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
CreatePipe
GetExitCodeProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
WriteFile
HeapSize
InitializeCriticalSection
RaiseException
SetStdHandle
SetFilePointer
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
shlwapi
PathFindFileNameA
advapi32
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA
user32
ShowWindow
GetWindowThreadProcessId
PostMessageA
EnumWindows
GetForegroundWindow
FindWindowA
MessageBoxA
shell32
ShellExecuteA
Sections
.text Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ