Behavioral task
behavioral1
Sample
wbfs_inteligent_gui_v6/wbfs.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
wbfs_inteligent_gui_v6/wbfs.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
wbfs_inteligent_gui_v6/wbfs_hermes.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
wbfs_inteligent_gui_v6/wbfs_hermes.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
wbfs_inteligent_gui_v6/wbfs_inteligent_gui_v6.exe
Resource
win7-20240705-en
General
-
Target
bf0f507bee2ec72aada333bf57d11e69_JaffaCakes118
-
Size
1.6MB
-
MD5
bf0f507bee2ec72aada333bf57d11e69
-
SHA1
f8d796ee3b5f64d3afc91385b3c5b7301b3ef0c3
-
SHA256
f73bd87c3a78f5cca7721e2f1dd386c7cc413073664cc71b27e07a0aa71b0a07
-
SHA512
1d444ba1ba894208c8aa8bf85c1ed853f880e78624814cc5411521f72f1050b36eb827599ecf5e0b1e81f1fb2ee8fcefa36f033c434e98704ddb00fa2959a41a
-
SSDEEP
49152:WwwsYVnhBrb418YQ0CYLebKxwOtdxD3aI7vtlBzugPOE3Pn:WwwsOhpb418YQNKxltvj7ntNPOcP
Malware Config
Signatures
-
resource yara_rule static1/unpack001/wbfs_inteligent_gui_v6/wbfs_inteligent_gui_v6.exe upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/wbfs_inteligent_gui_v6/wbfs.exe unpack001/wbfs_inteligent_gui_v6/wbfs_hermes.exe unpack001/wbfs_inteligent_gui_v6/wbfs_inteligent_gui_v6.exe unpack002/out.upx
Files
-
bf0f507bee2ec72aada333bf57d11e69_JaffaCakes118.rar
-
wbfs_inteligent_gui_v6/Readme.txt
-
wbfs_inteligent_gui_v6/images/R64E01.png.png
-
wbfs_inteligent_gui_v6/images/R7BP7J.png.jpg
-
wbfs_inteligent_gui_v6/images/RBKP69.png.png
-
wbfs_inteligent_gui_v6/images/REZPKM.png.png
-
wbfs_inteligent_gui_v6/images/RHKP18.png.png
-
wbfs_inteligent_gui_v6/images/RLIP64.png.png
-
wbfs_inteligent_gui_v6/images/RNIPGT.png.png
-
wbfs_inteligent_gui_v6/images/RSJP41.png.png
-
wbfs_inteligent_gui_v6/images/RT6PKM.png.png
-
wbfs_inteligent_gui_v6/images/RURPPL.png.png
-
wbfs_inteligent_gui_v6/images/RUUP01.png.png
-
wbfs_inteligent_gui_v6/images/RZRPGT.png.png
-
wbfs_inteligent_gui_v6/images/SMNP01.png.png
-
wbfs_inteligent_gui_v6/images/Thumbs.db
-
wbfs_inteligent_gui_v6/images/noimage.png.png
-
wbfs_inteligent_gui_v6/lang.ini
-
wbfs_inteligent_gui_v6/readme_wbfs_hermes.txt
-
wbfs_inteligent_gui_v6/readme_wbfs_hermes_new.txt
-
wbfs_inteligent_gui_v6/wbfs.exe.exe windows:5 windows x86 arch:x86
dc92217a30f10743359436a8fc0387ea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
ntohl
htonl
htons
ntohs
kernel32
TlsGetValue
GetProcessHeap
CreateFileA
SetEndOfFile
SetFilePointerEx
WriteFile
ReadFile
CreateDirectoryA
CopyFileA
CloseHandle
DeviceIoControl
GetLastError
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
GetSystemTimeAsFileTime
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
GetStdHandle
GetModuleFileNameA
SetFilePointer
MultiByteToWideChar
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
LCMapStringA
WideCharToMultiByte
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
Sections
.text Size: 89KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
wbfs_inteligent_gui_v6/wbfs_hermes.exe.exe windows:4 windows x86 arch:x86
f76e7286736db8c27f1e1afc2db68bb5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
GetOpenFileNameA
wsock32
htonl
htons
ntohl
ntohs
kernel32
AddAtomA
CloseHandle
CopyFileA
CreateDirectoryA
CreateFileA
DeviceIoControl
ExitProcess
FindAtomA
GetAtomNameA
ReadFile
SetEndOfFile
SetFilePointerEx
SetUnhandledExceptionFilter
WriteFile
msvcrt
_chdir
_getch
_getcwd
_kbhit
__getmainargs
__p___argv
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_filelengthi64
_iob
_onexit
_setmode
_snprintf
_vsnprintf
abort
atexit
exit
fclose
fflush
fgetpos
fopen
fprintf
fputc
fread
free
fseek
fsetpos
ftell
getchar
getenv
malloc
memchr
memcmp
memcpy
memset
perror
printf
signal
strchr
strcmp
strlen
strncmp
strncpy
strrchr
system
time
toupper
vfprintf
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 261KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
/4 Size: 512B - Virtual size: 288B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/19 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/35 Size: 31KB - Virtual size: 31KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/47 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/61 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/73 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/86 Size: 1024B - Virtual size: 673B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
wbfs_inteligent_gui_v6/wbfs_inteligent_gui_v6.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 420KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 253KB - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 495KB - Virtual size: 495KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ