LOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOL
Static task
static1
Behavioral task
behavioral1
Sample
Winject.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Winject.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
bf3hk5.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
bf3hk5.dll
Resource
win10v2004-20240802-en
General
-
Target
f5e83003666ee6d3ae39e4ac3331711e_JaffaCakes118
-
Size
175KB
-
MD5
f5e83003666ee6d3ae39e4ac3331711e
-
SHA1
00a3679a6db119f1c3ce784d8afa4e1573bf8634
-
SHA256
b1522ca83424c78f62050ccc4c78f3c027281fa6d4d33a906bf3f637a6ad86cd
-
SHA512
469e43a84c1e2bcade9465e98237ce1ba537458376d83809b94a11c802b455064da30afebe05b5d3ea8bee7802519de9b0cef40ddc796e71073f679319e17626
-
SSDEEP
3072:7U3WFWqEKunxbJzqF4eG0invCaZnQACfIyC5PypyCYCe2cwWC65gmcHXrZ2:7U3qDcbpqF4Y0vFjcTCNxCYCeNoig70
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Winject.exe unpack001/bf3hk5.dll
Files
-
f5e83003666ee6d3ae39e4ac3331711e_JaffaCakes118.zip
-
Winject.exe.exe windows:4 windows x86 arch:x86
6d3e5814450a38a649e01d0651a6e25e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
LoadLibraryA
GetExitCodeThread
LocalFree
FormatMessageA
UnmapViewOfFile
MapViewOfFile
LocalAlloc
DebugActiveProcess
TerminateProcess
FreeLibrary
GetFileSize
CreateFileA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
SetFilePointer
HeapReAlloc
VirtualAlloc
WriteFile
RtlUnwind
VirtualFreeEx
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
SuspendThread
FlushFileBuffers
FlushInstructionCache
SetThreadContext
CreateProcessA
ResumeThread
VirtualProtectEx
GetLastError
Module32First
Module32Next
GetModuleFileNameA
OpenProcess
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
CloseHandle
Process32Next
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetThreadContext
GetTickCount
SetUnhandledExceptionFilter
RaiseException
Sleep
IsDebuggerPresent
GetCurrentProcessId
GetCurrentProcess
VirtualFree
ReadProcessMemory
winmm
PlaySoundA
shlwapi
PathRemoveFileSpecA
PathCompactPathA
PathStripPathA
comdlg32
GetOpenFileNameA
user32
EnableMenuItem
DlgDirListComboBoxA
GetMenu
CheckMenuItem
GetAsyncKeyState
GetDlgItemTextA
SetFocus
DialogBoxParamA
GetDC
DrawIcon
ReleaseDC
KillTimer
GetSysColorBrush
EnableWindow
SetTimer
GetDesktopWindow
GetWindow
ShowWindow
GetClassLongA
GetClientRect
InvalidateRect
UpdateWindow
GetWindowThreadProcessId
MessageBoxA
FindWindowA
FindWindowExA
EnumWindows
SetWindowTextA
GetSysColor
SetRect
DrawIconEx
GetDlgItem
LoadIconA
SendMessageA
EndDialog
GetWindowTextA
GetDialogBaseUnits
MoveWindow
SendMessageTimeoutA
SetDlgItemTextA
advapi32
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
RegDeleteKeyA
OpenProcessToken
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
gdi32
CreateFontA
SelectObject
DeleteObject
SetBkColor
SetTextColor
SetBkMode
GetTextExtentPoint32A
GetTextMetricsA
ExtTextOutA
Sections
.text Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
bf3hk5.dll.dll windows:5 windows x86 arch:x86
2f10a5ba77e9bf12ff57f1d9b25b2c45
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryA
GetLastError
GetProcAddress
CreateThread
LeaveCriticalSection
FreeLibrary
GetCurrentProcess
SetLastError
GetSystemTimeAsFileTime
VirtualProtect
VirtualProtectEx
GetStdHandle
EnterCriticalSection
SetConsoleTitleA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
AllocConsole
FlushInstructionCache
IsBadReadPtr
user32
GetAsyncKeyState
SetRect
FillRect
gdi32
GetCurrentObject
CreateSolidBrush
DeleteObject
GetObjectA
msvcp90
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
msvcr90
_open_osfhandle
clock
_fdopen
mbtowc
_purecall
ceil
??_V@YAXPAX@Z
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
floor
setvbuf
__iob_func
strstr
_vsnprintf_s
?what@exception@std@@UBEPBDXZ
??2@YAPAXI@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
printf
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??3@YAXPAX@Z
memmove_s
_CIsqrt
_CIsin
_CIcos
_CIatan2
memset
memcpy
strchr
_vsnprintf
atoi
isdigit
_stricmp
isspace
__CxxFrameHandler3
_CxxThrowException
d3dx9_43
D3DXVec4Transform
d3dx11_43
D3DX11CompileFromMemory
d3dcompiler_43
D3DGetInputSignatureBlob
D3DReflect
Exports
Exports
??4_Init_locks@std@@QAEAAV01@ABV01@@Z
FW1CreateFactory
_FW1CreateFactory@8
Sections
.text Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 31KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ