C:\exe.pdb
Behavioral task
behavioral1
Sample
f96d5bca786b9fe833ac48f9a2555cec_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f96d5bca786b9fe833ac48f9a2555cec_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f96d5bca786b9fe833ac48f9a2555cec_JaffaCakes118
-
Size
100KB
-
MD5
f96d5bca786b9fe833ac48f9a2555cec
-
SHA1
aa2f52dfc1cc88197a2048d37a2828fbd8f605a9
-
SHA256
e64bdd6df00f53aa534ddb0319855775bb039dff4ca50950bcb5c2bfd753fc15
-
SHA512
27aa3cfaf060b964522bda7b9b9393eaf859a2e9c87ea572c6dc861b21587e656c20ec0624b1ec46b1ddff72d7e725dd1be9d2487dbe02aa09bb2019dba771cf
-
SSDEEP
1536:IgzNZx6RVEefhy9mA1FCVKTDyTAteTlktUappp/MAhCnMrIMhP:nOfhy9mA1kUTWTAoTlktUZAUapP
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f96d5bca786b9fe833ac48f9a2555cec_JaffaCakes118
Files
-
f96d5bca786b9fe833ac48f9a2555cec_JaffaCakes118.exe windows:5 windows x86 arch:x86
45a28b729ac8dbc7ccfad6cee9749945
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
strstr
strrchr
srand
rand
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
memcpy
_except_handler3
shlwapi
SHDeleteKeyA
PathFileExistsA
SHSetValueA
SHGetValueA
ws2_32
WSAResetEvent
connect
htonl
htons
setsockopt
sendto
socket
WSACreateEvent
send
WSAStartup
WSACleanup
gethostbyname
inet_addr
inet_ntoa
gethostname
closesocket
WSARecvFrom
bind
WSAGetLastError
iphlpapi
GetAdaptersInfo
wintrust
WinVerifyTrust
mpr
WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum
WNetAddConnection2A
WNetCancelConnection2A
rpcrt4
UuidFromStringA
UuidToStringA
kernel32
GlobalFree
GetLocalTime
MoveFileExA
GlobalAlloc
TransactNamedPipe
GetExitCodeThread
GetLogicalDrives
GetFileAttributesA
FlushViewOfFile
SetFileAttributesA
FindNextFileA
FindClose
GetLogicalDriveStringsA
FindFirstFileA
LockResource
RemoveDirectoryA
ExitProcess
CreateFileA
GetFileSize
SetFilePointer
lstrlenA
VirtualQuery
SetEndOfFile
FreeLibrary
WaitForSingleObject
SetEvent
WriteFile
OpenProcess
Sleep
CreateEventA
ReadFile
GetSystemDirectoryA
MultiByteToWideChar
GetLastError
lstrcmpiA
GetProcAddress
LoadLibraryA
OpenEventA
GetModuleFileNameA
GetModuleHandleA
GetCurrentThreadId
CloseHandle
GetCurrentProcessId
GetTempPathA
DeleteFileA
FindResourceA
FreeResource
LoadResource
Process32First
GetTickCount
GetSystemTimeAsFileTime
SetFileTime
GetDriveTypeA
SizeofResource
CreateProcessA
lstrcatA
Process32Next
lstrcpynA
DeviceIoControl
SetNamedPipeHandleState
LoadLibraryExA
CreateToolhelp32Snapshot
GetFileTime
GetVersionExA
LocalFree
lstrcpyA
ConnectNamedPipe
TerminateThread
Thread32Next
ExitThread
DisconnectNamedPipe
FlushFileBuffers
CreateNamedPipeA
OpenThread
GetCurrentProcess
lstrlenW
VirtualProtect
CreateThread
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
WinExec
CreateDirectoryA
user32
SetThreadDesktop
OpenWindowStationA
UnloadKeyboardLayout
SetProcessWindowStation
LoadKeyboardLayoutA
GetMessageA
PostThreadMessageA
wsprintfA
wsprintfW
GetInputState
OpenDesktopA
FindWindowA
PostMessageA
advapi32
RegOpenKeyA
CloseServiceHandle
OpenProcessToken
GetTokenInformation
RegSetValueExA
RegQueryValueExA
CreateServiceA
StartServiceA
RegCreateKeyExA
CreateProcessAsUserA
AdjustTokenPrivileges
RegFlushKey
RegSaveKeyA
LookupPrivilegeValueA
RegRestoreKeyA
DeleteService
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
SetEntriesInAclA
RegCloseKey
OpenServiceA
ControlService
OpenSCManagerA
RegDeleteValueA
QueryServiceStatus
RegOpenKeyExA
shell32
ShellExecuteA
Sections
.text Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ