Static task
static1
Behavioral task
behavioral1
Sample
klwk/klwk.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
klwk/klwk.exe
Resource
win10v2004-20240802-en
General
-
Target
ddebb5adecc11066bc41869cdb2de94b_JaffaCakes118
-
Size
151KB
-
MD5
ddebb5adecc11066bc41869cdb2de94b
-
SHA1
c6f49165c973ff8d14f22df3ebdc110f94afcb88
-
SHA256
80ed3e09cf3d0ac77bdeff1d0e73bde955563651704fba3c5e5e8b3b2160dfbb
-
SHA512
7c80195cde738d0d37c3052e1e37721bfd8842067f0f95c6bba186f7c79e09fc7b57203412f79a8cfbcfc4107263e0781198317817b374449259b252f69ee3ae
-
SSDEEP
3072:/puVFq3YxpSSuyn4AUV6xHQy/5HZH286au0t0gj+VZ7fSuhgbr2C:/YVxpSSZttQy/5Hp286h+jQZ5hgbT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/klwk/klwk.com
Files
-
ddebb5adecc11066bc41869cdb2de94b_JaffaCakes118.rar
-
klwk/ReadMe.txt
-
klwk/WhatsNew.txt
-
klwk/eula.txt
-
klwk/klwk.com.exe windows:4 windows x86 arch:x86
cff4d613cb4bafdb61c30a49c4be98cc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shfolder
SHGetFolderPathA
iphlpapi
GetAdaptersInfo
user32
ExitWindowsEx
wsprintfA
psapi
GetModuleFileNameExA
shlwapi
StrStrIA
kernel32
GetProcAddress
LoadLibraryA
MultiByteToWideChar
Process32Next
TerminateProcess
OpenProcess
lstrcmpA
Process32First
CreateToolhelp32Snapshot
GetTickCount
GetSystemDirectoryA
GetDriveTypeA
ExitProcess
MoveFileA
CopyFileA
ReadProcessMemory
VirtualQueryEx
GetSystemInfo
WriteFile
GetFileAttributesA
lstrcpynA
GetShortPathNameA
GetTempFileNameA
GetWindowsDirectoryA
SetEndOfFile
SetFilePointer
GetFullPathNameA
Thread32Next
SuspendThread
OpenThread
Thread32First
GetVersionExA
RemoveDirectoryA
lstrlenA
DuplicateHandle
ReadFile
UnmapViewOfFile
lstrcatA
CreateFileMappingA
FreeResource
VirtualFree
VirtualAlloc
LockResource
LoadResource
GetModuleHandleA
TerminateThread
FindResourceA
FreeLibrary
GetModuleFileNameA
GetLocalTime
WritePrivateProfileStringA
GetPrivateProfileStringA
WideCharToMultiByte
SizeofResource
WritePrivateProfileSectionA
GetPrivateProfileSectionA
GetTempPathA
ReleaseMutex
CreateMutexA
SetConsoleTitleA
GetCurrentProcessId
GetCurrentDirectoryA
lstrlenW
WaitForSingleObject
DeviceIoControl
GetDiskFreeSpaceA
GetFileType
QueryDosDeviceA
GetLogicalDriveStringsA
lstrcmpiA
GetExitCodeThread
CreateThread
lstrcmpW
lstrcpyA
CreateFileA
SetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose
DeleteFileA
GetVolumeInformationA
GetFileSize
VirtualProtectEx
GetCurrentProcess
CloseHandle
Sleep
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
SetEnvironmentVariableA
HeapSize
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
MapViewOfFile
CompareStringW
CompareStringA
GetLocaleInfoA
IsBadCodePtr
RtlUnwind
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
RaiseException
HeapReAlloc
GetCommandLineA
GetSystemTimeAsFileTime
SetHandleCount
GetStdHandle
GetStartupInfoA
QueryPerformanceCounter
GetCurrentThreadId
InterlockedExchange
VirtualQuery
HeapDestroy
HeapCreate
IsBadWritePtr
FlushFileBuffers
VirtualProtect
GetACP
GetOEMCP
GetCPInfo
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle
GetExitCodeProcess
CreateProcessA
IsBadReadPtr
advapi32
ControlService
DeleteService
OpenServiceA
OpenSCManagerA
CreateServiceA
RegCreateKeyA
CloseServiceHandle
RegDeleteValueA
RegSetValueA
RegEnumKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegGetKeySecurity
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetAclInformation
GetAce
IsValidSid
LookupAccountSidA
GetSecurityDescriptorDacl
GetFileSecurityA
RegDeleteKeyA
shell32
SHGetSpecialFolderPathA
SHFileOperationA
ShellExecuteA
Sections
.text Size: 204KB - Virtual size: 202KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 76KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ