Behavioral task
behavioral1
Sample
Hi.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Hi.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
[cheat-project.com] WinJect 1.7 2009-05-02/Winject.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
[cheat-project.com] WinJect 1.7 2009-05-02/Winject.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
[cheat-project.com] WinJect 1.7 2009-05-02/minime.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
[cheat-project.com] WinJect 1.7 2009-05-02/minime.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
[cheat-project.com] WinJect 1.7 2009-05-02/skype.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
[cheat-project.com] WinJect 1.7 2009-05-02/skype.dll
Resource
win10v2004-20240709-en
General
-
Target
3b24884dbe583dd5d90f2efe274aede9_JaffaCakes118
-
Size
143KB
-
MD5
3b24884dbe583dd5d90f2efe274aede9
-
SHA1
4b333c74b435287ca6f57928d50cc918d9325494
-
SHA256
6b7a2f8a543ed3ce00006945986f197392d004d8a970aa41bfe3dc3a81c936cc
-
SHA512
9fcf650054ddaae9a311651c3a73524f0c6c02c92c290c419505ed7cd292d6422adc6433e761286d6e74daf0c8621796d0da2a58ba03dd0315bbe16e33cd4cc0
-
SSDEEP
3072:M3EHjR5BkWZ9/rs88VSzehuTj78ezMT+TnABPG:rz/jsIaGBzMT4nABPG
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Hi.exe upx -
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Hi.exe unpack001/[cheat-project.com] WinJect 1.7 2009-05-02/Winject.exe unpack001/[cheat-project.com] WinJect 1.7 2009-05-02/minime.dll unpack001/[cheat-project.com] WinJect 1.7 2009-05-02/skype.dll
Files
-
3b24884dbe583dd5d90f2efe274aede9_JaffaCakes118.rar
-
Hi.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 116KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 51KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
[cheat-project.com] WinJect 1.7 2009-05-02/Winject.exe.exe windows:4 windows x86 arch:x86
6d3e5814450a38a649e01d0651a6e25e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
LoadLibraryA
GetExitCodeThread
LocalFree
FormatMessageA
UnmapViewOfFile
MapViewOfFile
LocalAlloc
DebugActiveProcess
TerminateProcess
FreeLibrary
GetFileSize
CreateFileA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
SetFilePointer
HeapReAlloc
VirtualAlloc
WriteFile
RtlUnwind
VirtualFreeEx
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
SuspendThread
FlushFileBuffers
FlushInstructionCache
SetThreadContext
CreateProcessA
ResumeThread
VirtualProtectEx
GetLastError
Module32First
Module32Next
GetModuleFileNameA
OpenProcess
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
CloseHandle
Process32Next
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetThreadContext
GetTickCount
SetUnhandledExceptionFilter
RaiseException
Sleep
IsDebuggerPresent
GetCurrentProcessId
GetCurrentProcess
VirtualFree
ReadProcessMemory
winmm
PlaySoundA
shlwapi
PathRemoveFileSpecA
PathCompactPathA
PathStripPathA
comdlg32
GetOpenFileNameA
user32
EnableMenuItem
DlgDirListComboBoxA
GetMenu
CheckMenuItem
GetAsyncKeyState
GetDlgItemTextA
SetFocus
DialogBoxParamA
GetDC
DrawIcon
ReleaseDC
KillTimer
GetSysColorBrush
EnableWindow
SetTimer
GetDesktopWindow
GetWindow
ShowWindow
GetClassLongA
GetClientRect
InvalidateRect
UpdateWindow
GetWindowThreadProcessId
MessageBoxA
FindWindowA
FindWindowExA
EnumWindows
SetWindowTextA
GetSysColor
SetRect
DrawIconEx
GetDlgItem
LoadIconA
SendMessageA
EndDialog
GetWindowTextA
GetDialogBaseUnits
MoveWindow
SendMessageTimeoutA
SetDlgItemTextA
advapi32
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
RegDeleteKeyA
OpenProcessToken
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
gdi32
CreateFontA
SelectObject
DeleteObject
SetBkColor
SetTextColor
SetBkMode
GetTextExtentPoint32A
GetTextMetricsA
ExtTextOutA
Sections
.text Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
[cheat-project.com] WinJect 1.7 2009-05-02/minime.dll.dll windows:4 windows x86 arch:x86
239fe39646770f27ba11f1d5318213ee
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ReadProcessMemory
GetThreadContext
GetProcAddress
GetModuleHandleA
GetCurrentProcess
DisableThreadLibraryCalls
SetLastError
VirtualProtect
FlushInstructionCache
LoadLibraryA
GetCommandLineA
GetVersion
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
HeapAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
Sections
.text Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
[cheat-project.com] WinJect 1.7 2009-05-02/readme.txt
-
[cheat-project.com] WinJect 1.7 2009-05-02/skype.dll.dll windows:4 windows x86 arch:x86
3c5102c265d375dbd63a4be9d6b91fcb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
GetModuleHandleA
GetCurrentProcess
DisableThreadLibraryCalls
SetLastError
VirtualProtect
FlushInstructionCache
LoadLibraryA
GetCommandLineA
GetVersion
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
HeapAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
user32
ShowWindow
SetForegroundWindow
SetWindowPos
Sections
.text Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
[cheat-project.com] WinJect 1.7 2009-05-02/uc.txt