D:\Works\Hupoo\Bin\Hupoo\HupooShell.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0a27291f79373bac80bc178158d74cf1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0a27291f79373bac80bc178158d74cf1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0a27291f79373bac80bc178158d74cf1_JaffaCakes118
-
Size
28KB
-
MD5
0a27291f79373bac80bc178158d74cf1
-
SHA1
aa675163ac7a4664b0f8e8cc565384bd53acf912
-
SHA256
6a3d6b6d905cfbc0df3fb8a59948b48514f5525856b0b3ac775d77be2c3a4f8d
-
SHA512
5512468247a241ad483ec3ef22ad7d07fde18df6f5f04a780fd6e28869afd07d67acccd4f527d72baec6d70f3d912703006d4c5635f95952ed33c72df0bcb386
-
SSDEEP
768:rzG9MotX/IRF34du0ZuCMjYlO2aF2csEyRlB4:rzSMotXEF3ynuFjAqaBl6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a27291f79373bac80bc178158d74cf1_JaffaCakes118
Files
-
0a27291f79373bac80bc178158d74cf1_JaffaCakes118.exe windows:4 windows x86 arch:x86
2c3d17b57837dd9d53b8a3b46673b81b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
VirtualProtect
GetCommandLineA
GetStringTypeW
GetStringTypeA
OpenProcess
GetCurrentProcess
lstrcmpA
GetSystemDirectoryA
WriteFile
CreateFileA
CloseHandle
ReadFile
lstrcpyA
lstrcatA
CreateProcessA
GetLastError
WaitForSingleObject
GetLocaleInfoA
lstrlenA
LCMapStringW
MultiByteToWideChar
LCMapStringA
HeapSize
GetCPInfo
GetOEMCP
GetSystemInfo
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
HeapFree
HeapAlloc
GetProcAddress
TerminateProcess
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
VirtualAlloc
HeapReAlloc
GetACP
user32
SendMessageA
MessageBoxA
FindWindowA
advapi32
RegQueryValueExA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegFlushKey
RegCreateKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
RegOpenKeyExA
wininet
InternetReadFile
InternetOpenA
InternetCheckConnectionA
InternetCloseHandle
InternetOpenUrlA
InternetAttemptConnect
Sections
.text Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ