r:\rel27\tmp\gewois\_bin\InstallU.pdb
Behavioral task
behavioral1
Sample
3fa1fe3debdbe9ac4dd09656559faa63_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
3fa1fe3debdbe9ac4dd09656559faa63_JaffaCakes118
-
Size
449KB
-
MD5
3fa1fe3debdbe9ac4dd09656559faa63
-
SHA1
c06068bf6826b56d2cdf5415713fef3b5c075e51
-
SHA256
d7a8cc96f45f85958dbf4e1d72e5038e65010511c7eee201908cab7800807b05
-
SHA512
9ad5e13d841ba0f508a96448d7d6245238ef6dcc66fd503786ac8b8df77de82e852e02dfab9d5fb2d6f61a24a50b51b561d044d73b4faa1fb1673a3b171ad0c4
-
SSDEEP
6144:OcTGy8tbuzyIhrMPJXKhmZxL8hAbhRuDzyIhrMPJXKhmZxL8hAbhRu:RTGy0vILh8LYcRuCILh8LYcRu
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3fa1fe3debdbe9ac4dd09656559faa63_JaffaCakes118
Files
-
3fa1fe3debdbe9ac4dd09656559faa63_JaffaCakes118.exe windows:4 windows x86 arch:x86
5d06de0aff27fbe2feeaced32853aa1d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
setupapi
SetupAddToSourceListW
SetupRemoveFromSourceListW
SetupDiChangeState
SetupCopyOEMInfW
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiBuildDriverInfoList
SetupDiEnumDriverInfoW
SetupDiOpenDevRegKey
SetupDiGetDriverInfoDetailW
SetupDiDestroyDriverInfoList
CM_Locate_DevNode_ExW
CM_Reenumerate_DevNode_Ex
SetupDiGetDeviceRegistryPropertyW
kernel32
GetExitCodeProcess
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetProcAddress
LoadLibraryW
lstrcpyW
DeleteFileW
GetModuleFileNameW
LocalFree
FormatMessageW
GetLastError
CreateFileA
GetModuleHandleW
FreeLibrary
GetFileAttributesW
GetFullPathNameW
lstrlenW
lstrcatW
GetWindowsDirectoryW
CloseHandle
WaitForSingleObject
CreateProcessW
GetVersionExW
FindClose
FindFirstFileW
GetSystemDirectoryW
CopyFileW
SetFileAttributesW
Sleep
InitializeCriticalSection
WriteFile
SetFilePointer
CreateFileW
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetLastError
GetStartupInfoW
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapFree
HeapAlloc
GetVersionExA
GetProcessHeap
SetEnvironmentVariableW
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryA
GetStringTypeA
GetStringTypeW
advapi32
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
Sections
.text Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE