Behavioral task
behavioral1
Sample
edf6cba6bcc021564c389d2755b3d0c9_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
edf6cba6bcc021564c389d2755b3d0c9_JaffaCakes118.exe
Resource
win10v2004-20231215-en
General
-
Target
edf6cba6bcc021564c389d2755b3d0c9_JaffaCakes118
-
Size
216KB
-
MD5
edf6cba6bcc021564c389d2755b3d0c9
-
SHA1
78b2dcbf8ae4b21026d5ad85b49a7ae199fdfa63
-
SHA256
54f243bd2070da61354eb3a994d19106d7932c7766de590b7070c5129d1a7eb4
-
SHA512
33e79bc61dd5fde44aa0fe86f20c35cbefc5cea57db1f25033e1daff996a83c9c5a60f981c56eb768cae621d04e2dd329a2eda1555d337111ce8c6aa37d0635d
-
SSDEEP
1536:eJPahEvGIVD5r0ck2LipBJf0ZwrsWIG8L55KYwxRH:WP7vVD5gELipHf4wrsW18L5ORH
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource edf6cba6bcc021564c389d2755b3d0c9_JaffaCakes118
Files
-
edf6cba6bcc021564c389d2755b3d0c9_JaffaCakes118.exe windows:4 windows x86 arch:x86
56f0d755b7d4950e612f2616892efd58
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
WideCharToMultiByte
GetProcAddress
LoadLibraryA
GetModuleHandleA
lstrcpyA
HeapAlloc
GetProcessHeap
lstrcmpiA
lstrcmpA
lstrcatA
lstrcpynA
GlobalFree
HeapFree
CreateThread
Sleep
ExitThread
InterlockedDecrement
InterlockedIncrement
DeleteFileA
GlobalAlloc
GetFileSize
CreateFileA
GetTempFileNameA
GetTempPathA
GetModuleFileNameA
ReadFile
GetEnvironmentVariableA
CreateProcessA
FindClose
FindNextFileA
FindFirstFileA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetDriveTypeA
GetSystemDirectoryA
SetThreadPriority
GetCurrentThread
GetLastError
CreateMutexA
CopyFileA
GetFileAttributesA
SetFileAttributesA
SystemTimeToFileTime
GetSystemTimeAsFileTime
WriteFile
ExitProcess
SetFilePointer
GetSystemTime
SetStdHandle
HeapReAlloc
VirtualAlloc
FlushFileBuffers
GetOEMCP
GetACP
WaitForSingleObject
CloseHandle
GetTickCount
GetLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetWindowsDirectoryA
GetTimeZoneInformation
GetCPInfo
HeapValidate
IsBadReadPtr
IsBadWritePtr
SetConsoleCtrlHandler
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
OutputDebugStringA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
TerminateProcess
GetCurrentProcess
advapi32
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumKeyA
user32
CharUpperBuffA
wvsprintfA
CharUpperA
CharLowerA
wsprintfA
ws2_32
Sections
UPX0 Size: 212KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE