Static task
static1
Behavioral task
behavioral1
Sample
gpup_336.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
gpup_336.exe
Resource
win10v2004-20240508-en
General
-
Target
7b8ded8fe9d69d465fa17ae6e0eb9c2d_JaffaCakes118
-
Size
51KB
-
MD5
7b8ded8fe9d69d465fa17ae6e0eb9c2d
-
SHA1
4521054a24efb7a5a7cbe2db2bbf472a5782b67e
-
SHA256
0a265f7af8d85d5aadc7e978f296c77d0b9c72763ffc76f69bef9cff498aaa48
-
SHA512
a1a8ccd9787ed4f83182292cbd917ad87f2bfc3576c2e9d912ffe103b8e3dc89a9e04f88f1dd6257248a6f0405a0ddcb8c0d14346a6faa53cb22f42e1b388b2e
-
SSDEEP
1536:f7u0XJSJFre+S5powQQiVqAxDYadBK7p0ipv:f7uyJSJFre+KEbVqKDBfa1p
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/gpup_336.exe
Files
-
7b8ded8fe9d69d465fa17ae6e0eb9c2d_JaffaCakes118.7z
Password: infected
-
gpup_336.exe.exe windows:5 windows x86 arch:x86
e33229a1aca97f02759978dcd5378937
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
oleaut32
VariantClear
VariantInit
SysFreeString
SysAllocString
iphlpapi
GetAdaptersInfo
advapi32
RegOpenKeyExW
GetUserNameW
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
RegCloseKey
RegCreateKeyExW
RegSetValueExA
RegQueryValueExW
CryptGetHashParam
ole32
CoInitialize
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoInitializeEx
kernel32
SetEndOfFile
ReadFile
GetEnvironmentStringsW
CreateFileW
CreateFileA
WriteConsoleW
FlushFileBuffers
GetProcAddress
GetModuleHandleA
WaitForSingleObject
GetCurrentProcess
ExpandEnvironmentStringsW
GetProcessHeap
LoadLibraryA
MoveFileExW
HeapAlloc
GetVolumeInformationW
GetSystemDirectoryW
GetLastError
GetVersionExA
CopyFileExW
GetVolumeInformationA
GetWindowsDirectoryA
lstrcpyA
InterlockedDecrement
lstrcatA
GetSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetLocalTime
GetVersionExW
HeapReAlloc
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
LocalFree
GetCommandLineW
HeapSetInformation
GetSystemTimeAsFileTime
HeapFree
RtlUnwind
EncodePointer
DecodePointer
RaiseException
SetUnhandledExceptionFilter
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
SetStdHandle
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
IsProcessorFeaturePresent
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CloseHandle
GetConsoleCP
GetConsoleMode
Sleep
HeapSize
LoadLibraryW
SetFilePointer
CompareStringW
SetEnvironmentVariableA
LCMapStringW
GetStringTypeW
user32
wsprintfW
wsprintfA
winhttp
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpConnect
WinHttpOpen
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpReadData
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ