Overview
overview
5Static
static
5hhcode_and...tEx.js
windows7-x64
3hhcode_and...tEx.js
windows10-2004-x64
3hhcode_and...Ex.exe
windows7-x64
5hhcode_and...Ex.exe
windows10-2004-x64
5hhcode_and...oad.js
windows7-x64
3hhcode_and...oad.js
windows10-2004-x64
3hhcode_and...ad.exe
windows7-x64
5hhcode_and...ad.exe
windows10-2004-x64
5hhcode_and...oad.js
windows7-x64
3hhcode_and...oad.js
windows10-2004-x64
3hhcode_and...ad.exe
windows7-x64
5hhcode_and...ad.exe
windows10-2004-x64
5hhcode_and...elp.js
windows7-x64
3hhcode_and...elp.js
windows10-2004-x64
3hhcode_and...lp.exe
windows7-x64
5hhcode_and...lp.exe
windows10-2004-x64
5hhcode_and...lp.htm
windows7-x64
3hhcode_and...lp.htm
windows10-2004-x64
3hhcode_and...ie.htm
windows7-x64
3hhcode_and...ie.htm
windows10-2004-x64
3hhcode_and...in.htm
windows7-x64
3hhcode_and...in.htm
windows10-2004-x64
3hhcode_and...dy.htm
windows7-x64
3hhcode_and...dy.htm
windows10-2004-x64
3hhcode_and...by.htm
windows7-x64
3hhcode_and...by.htm
windows10-2004-x64
3hhcode_and...LP.chm
windows7-x64
1hhcode_and...LP.chm
windows10-2004-x64
1hhcode_and...P.html
windows7-x64
3hhcode_and...P.html
windows10-2004-x64
3hhcode_and...P.html
windows7-x64
3hhcode_and...P.html
windows10-2004-x64
3Behavioral task
behavioral1
Sample
hhcode_and_exe BCB/Example 0/HHKitEx.js
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
hhcode_and_exe BCB/Example 0/HHKitEx.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
hhcode_and_exe BCB/Example 0/HHKitEx.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
hhcode_and_exe BCB/Example 0/HHKitEx.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
hhcode_and_exe BCB/Example 1/StaticLoad.js
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
hhcode_and_exe BCB/Example 1/StaticLoad.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
hhcode_and_exe BCB/Example 1/StaticLoad.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
hhcode_and_exe BCB/Example 1/StaticLoad.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
hhcode_and_exe BCB/Example 2/DynamicLoad.js
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
hhcode_and_exe BCB/Example 2/DynamicLoad.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
hhcode_and_exe BCB/Example 2/DynamicLoad.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
hhcode_and_exe BCB/Example 2/DynamicLoad.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
hhcode_and_exe BCB/Example 3/HookingHelp.js
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
hhcode_and_exe BCB/Example 3/HookingHelp.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
hhcode_and_exe BCB/Example 3/HookingHelp.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
hhcode_and_exe BCB/Example 3/HookingHelp.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
hhcode_and_exe BCB/TestCHM/Agent/AgentHelp.htm
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
hhcode_and_exe BCB/TestCHM/Agent/AgentHelp.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
hhcode_and_exe BCB/TestCHM/Agent/Genie.htm
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
hhcode_and_exe BCB/TestCHM/Agent/Genie.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
hhcode_and_exe BCB/TestCHM/Agent/Merlin.htm
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
hhcode_and_exe BCB/TestCHM/Agent/Merlin.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
hhcode_and_exe BCB/TestCHM/Agent/Peedy.htm
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
hhcode_and_exe BCB/TestCHM/Agent/Peedy.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
hhcode_and_exe BCB/TestCHM/Agent/Robby.htm
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
hhcode_and_exe BCB/TestCHM/Agent/Robby.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
hhcode_and_exe BCB/TestCHM/HELP.chm
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
hhcode_and_exe BCB/TestCHM/HELP.chm
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
hhcode_and_exe BCB/TestCHM/HELP.html
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
hhcode_and_exe BCB/TestCHM/HELP.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
hhcode_and_exe BCB/TestCHM/HELP.html
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
hhcode_and_exe BCB/TestCHM/HELP.html
Resource
win10v2004-20241007-en
General
-
Target
37787eb75b2ef7139d26d10f8ee0911c_JaffaCakes118
-
Size
1.1MB
-
MD5
37787eb75b2ef7139d26d10f8ee0911c
-
SHA1
6c8e05d2e176061fad262ef24114b22ae1eedfef
-
SHA256
bff6721f65dac12b339c83b5035e16f95c2c075dbf677db564f88ed9dddd881f
-
SHA512
c24db0f07b2852762804382f19c79b28b459f33600a23a76241e96ca571577f581cff258dd889dccbb11aeb9be1072f4ce8d0954a7c6c4d13a3f2453dd0480e2
-
SSDEEP
24576:ur9YKBQL95/XulRBQuybAKmXPb04ZMjlFnFTrBj7wQdnKWOhisJ/ts:E7qZ5/+FQfbA/T04ZMXFHNEQtFOIsFts
Malware Config
Signatures
-
resource yara_rule static1/unpack001/hhcode_and_exe BCB/Example 0/HHKitEx.exe upx static1/unpack001/hhcode_and_exe BCB/Example 1/StaticLoad.exe upx static1/unpack001/hhcode_and_exe BCB/Example 2/DynamicLoad.exe upx static1/unpack001/hhcode_and_exe BCB/Example 3/HookingHelp.exe upx -
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/hhcode_and_exe BCB/Example 0/HHKitEx.exe unpack001/hhcode_and_exe BCB/Example 1/StaticLoad.exe unpack001/hhcode_and_exe BCB/Example 2/DynamicLoad.exe unpack001/hhcode_and_exe BCB/Example 3/HookingHelp.exe
Files
-
37787eb75b2ef7139d26d10f8ee0911c_JaffaCakes118.zip
-
hhcode_and_exe BCB/Example 0/HHKitEx.bpr.xml
-
hhcode_and_exe BCB/Example 0/HHKitEx.cpp.js
-
hhcode_and_exe BCB/Example 0/HHKitEx.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 312KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 168KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
hhcode_and_exe BCB/Example 0/HHKitEx.res
-
hhcode_and_exe BCB/Example 0/Unit1.cpp
-
hhcode_and_exe BCB/Example 0/Unit1.dfm
-
hhcode_and_exe BCB/Example 0/Unit1.h
-
hhcode_and_exe BCB/Example 0/readme.txt
-
hhcode_and_exe BCB/Example 1/StaticLoad.bpr.xml
-
hhcode_and_exe BCB/Example 1/StaticLoad.cpp.js
-
hhcode_and_exe BCB/Example 1/StaticLoad.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 284KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 154KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
hhcode_and_exe BCB/Example 1/StaticLoad.res
-
hhcode_and_exe BCB/Example 1/Unit1.cpp
-
hhcode_and_exe BCB/Example 1/Unit1.dfm
-
hhcode_and_exe BCB/Example 1/Unit1.h
-
hhcode_and_exe BCB/Example 1/htmlhelp.lib
-
hhcode_and_exe BCB/Example 1/readme.txt
-
hhcode_and_exe BCB/Example 2/DynamicLoad.bpr.xml
-
hhcode_and_exe BCB/Example 2/DynamicLoad.cpp.js
-
hhcode_and_exe BCB/Example 2/DynamicLoad.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 284KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 155KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
hhcode_and_exe BCB/Example 2/DynamicLoad.res
-
hhcode_and_exe BCB/Example 2/Readme.txt
-
hhcode_and_exe BCB/Example 2/Unit1.cpp
-
hhcode_and_exe BCB/Example 2/Unit1.dfm
-
hhcode_and_exe BCB/Example 2/Unit1.h
-
hhcode_and_exe BCB/Example 3/HookingHelp.bpr.xml
-
hhcode_and_exe BCB/Example 3/HookingHelp.cpp.js
-
hhcode_and_exe BCB/Example 3/HookingHelp.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 280KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 153KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
hhcode_and_exe BCB/Example 3/HookingHelp.res
-
hhcode_and_exe BCB/Example 3/Readme.txt
-
hhcode_and_exe BCB/Example 3/Unit1.cpp
-
hhcode_and_exe BCB/Example 3/Unit1.dfm
-
hhcode_and_exe BCB/Example 3/Unit1.h
-
hhcode_and_exe BCB/Lib/htmlhelp.lib
-
hhcode_and_exe BCB/Lib/readme.txt
-
hhcode_and_exe BCB/TestCHM/Agent/AgentHelp.htm.html
-
hhcode_and_exe BCB/TestCHM/Agent/Genie.htm.html
-
hhcode_and_exe BCB/TestCHM/Agent/Merlin.htm.html
-
hhcode_and_exe BCB/TestCHM/Agent/Peedy.htm.html
-
hhcode_and_exe BCB/TestCHM/Agent/Robby.htm.html
-
hhcode_and_exe BCB/TestCHM/Agent/images/GENIEGREET.GIF.gif
-
hhcode_and_exe BCB/TestCHM/Agent/images/GENIEREST.GIF.gif
-
hhcode_and_exe BCB/TestCHM/Agent/images/Genie.gif.gif
-
hhcode_and_exe BCB/TestCHM/Agent/images/MERLINGREET.GIF.gif
-
hhcode_and_exe BCB/TestCHM/Agent/images/MERLINREST.GIF.gif
-
hhcode_and_exe BCB/TestCHM/Agent/images/Merlin.gif.gif
-
hhcode_and_exe BCB/TestCHM/Agent/images/PEEDYREST.gif.gif
-
hhcode_and_exe BCB/TestCHM/Agent/images/Peewee.gif.gif
-
hhcode_and_exe BCB/TestCHM/Agent/images/ROBBYGREET.GIF.gif
-
hhcode_and_exe BCB/TestCHM/Agent/images/ROBBYREST.GIF.gif
-
hhcode_and_exe BCB/TestCHM/Agent/images/Robby.gif.gif
-
hhcode_and_exe BCB/TestCHM/Agent/images/VIDAPP.gif.gif
-
hhcode_and_exe BCB/TestCHM/Agent/images/peedygreet.gif.gif
-
hhcode_and_exe BCB/TestCHM/COM/helpx.htm.html .js polyglot
-
hhcode_and_exe BCB/TestCHM/HELP.chm.chm
-
hhcode_and_exe BCB/TestCHM/HELP.hhc.html
-
hhcode_and_exe BCB/TestCHM/HELP.hhk.html
-
hhcode_and_exe BCB/TestCHM/HELP.hhp
-
hhcode_and_exe BCB/TestCHM/Log1.log
-
hhcode_and_exe BCB/TestCHM/TCard/tcard.htm.html
-
hhcode_and_exe BCB/TestCHM/cshelp.ali
-
hhcode_and_exe BCB/TestCHM/cshelp.h
-
hhcode_and_exe BCB/TestCHM/cshelp.txt
-
hhcode_and_exe BCB/TestCHM/default.htm.html
-
hhcode_and_exe BCB/TestCHM/hh_index.htm.html
-
hhcode_and_exe BCB/TestCHM/hh_start.htm.html
-
hhcode_and_exe BCB/TestCHM/hh_toc.htm.html
-
hhcode_and_exe BCB/TestCHM/htmlfiles/FileNotFound.htm.html
-
hhcode_and_exe BCB/TestCHM/htmlfiles/about.htm.html
-
hhcode_and_exe BCB/TestCHM/htmlfiles/testtopic1.htm.html
-
hhcode_and_exe BCB/TestCHM/htmlfiles/testtopic2.htm.html
-
hhcode_and_exe BCB/TestCHM/htmlfiles/testtopic3.htm.html
-
readme.txt