Behavioral task
behavioral1
Sample
f3452b5ae0e8e801f7294996ab3f6979_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3452b5ae0e8e801f7294996ab3f6979_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f3452b5ae0e8e801f7294996ab3f6979_JaffaCakes118
-
Size
149KB
-
MD5
f3452b5ae0e8e801f7294996ab3f6979
-
SHA1
c3224b2a7b1bad0605c1749501b42e5d48362df1
-
SHA256
b3eec987186c00a8a00c890a5cec9c3546ed4af752949053f2bf3c8b99e96865
-
SHA512
006b35eca4705577e76e3d291e7487780a377ed702beb90fca938e05671706d28494dda8a74736028ac79a17692f08826e5917b3dde358a41fcfaf8bb3d744a2
-
SSDEEP
3072:LlCwngfTvN6tU26K4/FL3rOZsAu74Vp9JO+iU7T:LIDTvN62qoHpk9k+iOT
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f3452b5ae0e8e801f7294996ab3f6979_JaffaCakes118
Files
-
f3452b5ae0e8e801f7294996ab3f6979_JaffaCakes118.exe windows:5 windows x86 arch:x86
5cdf2caab0eec3b62d14119d94a01c56
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_adjust_fdiv
__p__commode
memmove
__p__fmode
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_wcsicmp
_purecall
__CxxFrameHandler
??2@YAPAXI@Z
__set_app_type
_controlfp
__dllonexit
_onexit
_except_handler3
isdigit
??3@YAXPAX@Z
atl
ord30
ord32
ord17
ord23
ord21
ord16
ord20
advapi32
RegEnumKeyExW
RegQueryValueExW
StartServiceCtrlDispatcherW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegCloseKey
RegisterServiceCtrlHandlerW
SetServiceStatus
kernel32
GetStartupInfoW
GetModuleHandleA
CloseHandle
EnterCriticalSection
lstrcpyW
GetCurrentProcess
Sleep
WaitForMultipleObjects
WaitForSingleObject
UnregisterWait
DeleteTimerQueueTimer
RegisterWaitForSingleObject
BindIoCompletionCallback
ReadFile
WriteFile
HeapAlloc
GetProcessHeap
HeapFree
CreateEventW
SetEvent
CreateTimerQueueTimer
GetCurrentProcessId
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
CreateTimerQueue
InterlockedIncrement
InterlockedDecrement
DeleteTimerQueueEx
DuplicateHandle
ole32
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoInitializeEx
CLSIDFromString
oleaut32
SysAllocString
SysFreeString
wsock32
bind
WSAGetLastError
getsockname
ord1142
setsockopt
WSAStartup
htons
listen
WSACleanup
closesocket
ioctlsocket
htonl
shutdown
ord1141
getpeername
ntohs
ws2_32
WSAEventSelect
WSASocketW
WSAConnect
WSAEnumNetworkEvents
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 740B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE