Static task
static1
Behavioral task
behavioral1
Sample
Winject.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Winject.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
amozesh.docx
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
amozesh.docx
Resource
win10v2004-20241007-en
General
-
Target
2a65ad791ee4ffbad2195b6e989bf0c3_JaffaCakes118
-
Size
65KB
-
MD5
2a65ad791ee4ffbad2195b6e989bf0c3
-
SHA1
6b7e0d841da2af6d48fa10c974583813fbf76f62
-
SHA256
37938c8773a9ce5be082d0a1e72ba4268a12688964e514ff9b50a02054cf477e
-
SHA512
3cd6d7a30046581e3087ce52ce3d73f5e1a0d5593dc035719be4ec623c2590b3bb9a8be0e49cef1153e955462ddbe68b4f878ddaf8531eb7d7bc16fca4542927
-
SSDEEP
768:9ryfRmnqX9hrszBXQTfm5MSsP6EOAily/Ez/OldRuTs6Lny2kJdaIAZmge3j0uv7:ofR9/rsOf8sP6G2TmhuTj7kJeZmpF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Winject.exe
Files
-
2a65ad791ee4ffbad2195b6e989bf0c3_JaffaCakes118.rar
-
Winject.exe.exe windows:4 windows x86 arch:x86
6d3e5814450a38a649e01d0651a6e25e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
LoadLibraryA
GetExitCodeThread
LocalFree
FormatMessageA
UnmapViewOfFile
MapViewOfFile
LocalAlloc
DebugActiveProcess
TerminateProcess
FreeLibrary
GetFileSize
CreateFileA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
SetFilePointer
HeapReAlloc
VirtualAlloc
WriteFile
RtlUnwind
VirtualFreeEx
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
SuspendThread
FlushFileBuffers
FlushInstructionCache
SetThreadContext
CreateProcessA
ResumeThread
VirtualProtectEx
GetLastError
Module32First
Module32Next
GetModuleFileNameA
OpenProcess
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
CloseHandle
Process32Next
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetThreadContext
GetTickCount
SetUnhandledExceptionFilter
RaiseException
Sleep
IsDebuggerPresent
GetCurrentProcessId
GetCurrentProcess
VirtualFree
ReadProcessMemory
winmm
PlaySoundA
shlwapi
PathRemoveFileSpecA
PathCompactPathA
PathStripPathA
comdlg32
GetOpenFileNameA
user32
EnableMenuItem
DlgDirListComboBoxA
GetMenu
CheckMenuItem
GetAsyncKeyState
GetDlgItemTextA
SetFocus
DialogBoxParamA
GetDC
DrawIcon
ReleaseDC
KillTimer
GetSysColorBrush
EnableWindow
SetTimer
GetDesktopWindow
GetWindow
ShowWindow
GetClassLongA
GetClientRect
InvalidateRect
UpdateWindow
GetWindowThreadProcessId
MessageBoxA
FindWindowA
FindWindowExA
EnumWindows
SetWindowTextA
GetSysColor
SetRect
DrawIconEx
GetDlgItem
LoadIconA
SendMessageA
EndDialog
GetWindowTextA
GetDialogBaseUnits
MoveWindow
SendMessageTimeoutA
SetDlgItemTextA
advapi32
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
RegDeleteKeyA
OpenProcessToken
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
gdi32
CreateFontA
SelectObject
DeleteObject
SetBkColor
SetTextColor
SetBkMode
GetTextExtentPoint32A
GetTextMetricsA
ExtTextOutA
Sections
.text Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
amozesh.docx.docx office2007