Static task
static1
Behavioral task
behavioral1
Sample
echkpwd.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
echkpwd.exe
Resource
win10v2004-20240802-en
General
-
Target
df87eec4309feb9e2779d2304a9929cc_JaffaCakes118
-
Size
3KB
-
MD5
df87eec4309feb9e2779d2304a9929cc
-
SHA1
342125101381ed06362f3e7150e4ab7328f2a7f2
-
SHA256
18af5cc8b977cdda727a39fd7059fc0e7a5588f5450b8fbe056f983b99b3a156
-
SHA512
1881041453b61077b7e415bb27937e0493d7ce318ac8bd249035a49d7f8c1b008d8b1185d45c5a5552d75e460d75a6e5a0d15b11a33031b3c39eb1317e1db261
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/echkpwd.exe
Files
-
df87eec4309feb9e2779d2304a9929cc_JaffaCakes118.zip
-
echkpwd.c
-
echkpwd.exe.exe windows:4 windows x86 arch:x86
6dd4a023bf1fcafe0dc20459e3e5a1cf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
ExitProcess
SetUnhandledExceptionFilter
msvcrt
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
atexit
exit
fclose
fgetc
fgets
fopen
fwrite
perror
printf
signal
strchr
tolower
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 128B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE