Static task
static1
Behavioral task
behavioral1
Sample
Windows 8 UX Pack 2.0.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Windows 8 UX Pack 2.0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240802-en
General
-
Target
af6629feb64ce888d463f0658df43521_JaffaCakes118
-
Size
12.1MB
-
MD5
af6629feb64ce888d463f0658df43521
-
SHA1
19bdd4a5f6cb87aba08b854286310d453de80ef9
-
SHA256
1233cbcc640275f5f4dd5f5f97e4520339b1b689b7ccbe6c6cb9a5db627a07eb
-
SHA512
8e8a437ab43ebeffb593a17ce42880a9dce40c55a2e769330373849d0787090ee12e7234b73cae5812678a80fa42feee5b05a7e100065a03214f1ac310f2281e
-
SSDEEP
393216:cnOvUPymzPY/FXyDPht8gTq+H/lZik1IT3WOf/Mlb:cnamPexAPhyX+HdZuzWIUlb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Windows 8 UX Pack 2.0.exe
Files
-
af6629feb64ce888d463f0658df43521_JaffaCakes118.rar
-
Windows 8 UX Pack 2.0.exe.exe windows:4 windows x86 arch:x86
1b1f8bafc7e8e1dafb58725e16275805
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
GetVersionExA
OpenFile
FreeLibrary
GetProcAddress
LoadLibraryA
_lcreat
WinExec
_lopen
GetModuleFileNameA
GetModuleHandleA
GetCommandLineA
SetErrorMode
ExitProcess
_lwrite
GetLastError
lstrcatA
GlobalLock
FormatMessageA
LocalFree
lstrcpyA
GetTempPathA
GetWindowsDirectoryA
GetTempFileNameA
MulDiv
lstrlenA
_lread
_llseek
GlobalUnlock
GlobalFree
GlobalAlloc
_lclose
user32
ExitWindowsEx
wsprintfA
CreateWindowExA
ShowWindow
SetWindowPos
UpdateWindow
SetTimer
LoadIconA
LoadCursorA
RegisterClassA
MessageBoxA
BeginPaint
DrawTextA
EndPaint
InvalidateRect
PostQuitMessage
DefWindowProcA
GetDC
ReleaseDC
GetClientRect
SendMessageA
gdi32
SetTextColor
SetBkMode
SelectObject
StretchDIBits
CreateFontA
TextOutA
RealizePalette
SelectPalette
CreatePalette
GetStockObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
PatBlt
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
新云软件.url.url