Behavioral task
behavioral1
Sample
fb2ea51829c8c75cd05c4e4a9f4a289f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fb2ea51829c8c75cd05c4e4a9f4a289f_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fb2ea51829c8c75cd05c4e4a9f4a289f_JaffaCakes118
-
Size
250KB
-
MD5
fb2ea51829c8c75cd05c4e4a9f4a289f
-
SHA1
d9667f9876cec04503f75a20628d63ea0e3aa1d8
-
SHA256
88e65fa56d6c761f03dd048e1305f70e10f0e659c0a3c0bce712040690e3476e
-
SHA512
4405c0196ec5ede42289e7ccf5636d635c5721c834c487b8735ced1955446405abbea81e510f3095a793d40610ef9b7419243712fc5decf75c7d039a440ad217
-
SSDEEP
6144:BZ/4UHB0CnKk/T7J6bdULh3VvKsO5GTHYjlzIS:5Kk/TCdULxViZ5GrYjlzx
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fb2ea51829c8c75cd05c4e4a9f4a289f_JaffaCakes118
Files
-
fb2ea51829c8c75cd05c4e4a9f4a289f_JaffaCakes118.exe windows:4 windows x86 arch:x86
ee1f3aa89716293e7f70a15ad6bb3168
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetLastError
GetTickCount
GetCurrentProcess
MultiByteToWideChar
GetSystemDirectoryW
GetVersionExA
GetProcessHeap
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
HeapCreate
ExitProcess
GetModuleFileNameA
GetEnvironmentStringsW
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
GetModuleHandleW
GetProcAddress
user32
GetSystemMetrics
MessageBoxIndirectA
GetMenuItemRect
CreateDialogParamW
CharUpperA
PostQuitMessage
CharNextA
PostMessageA
GetTopWindow
GetIconInfo
EnumWindows
FindWindowW
DialogBoxParamW
SetCursor
SetDlgItemTextW
LoadImageA
CreateAcceleratorTableW
GetMenuStringA
DialogBoxIndirectParamW
wsprintfW
GetSubMenu
RegisterClassW
CopyIcon
SetActiveWindow
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
usp10
ScriptGetProperties
ScriptFreeCache
ScriptItemize
ScriptTextOut
ScriptString_pcOutChars
ScriptIsComplex
ScriptStringGetLogicalWidths
ScriptApplyDigitSubstitution
UspAllocCache
gdi32
RemoveFontResourceExW
CreateFontA
UpdateICMRegKeyA
CreatePolyPolygonRgn
RemoveFontResourceA
CreateScalableFontResourceW
CreateDIBPatternBrushPt
filemgmt
DllGetClassObject
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 1024B - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 79KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CODE Size: 512B - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 141KB - Virtual size: 237KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ