Behavioral task
behavioral1
Sample
fbd842e2231650ef579bb272a05f803e_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
fbd842e2231650ef579bb272a05f803e_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fbd842e2231650ef579bb272a05f803e_JaffaCakes118
-
Size
493KB
-
MD5
fbd842e2231650ef579bb272a05f803e
-
SHA1
0df3bf5e318be0aec110f7af6fbcafc2fc6d08d4
-
SHA256
33f7578133b51cb672c021f6a5e40ae06f339de707a53f149a4dcc7d71bf2879
-
SHA512
d022ffe3cbae547d9e4baaba0296a09b11370f00a028f898643a913ea633c2327d0a4c4c6a132ae77adf6c309120c8bea5d2dd6b14a6c1e9c96861c5e052c9e4
-
SSDEEP
12288:51N2p//suEZaO74cegcG1wIXjhAJpJT3sMxwsg0us:5KSCgfpcT3sawscs
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fbd842e2231650ef579bb272a05f803e_JaffaCakes118
Files
-
fbd842e2231650ef579bb272a05f803e_JaffaCakes118.exe windows:4 windows x86 arch:x86
fd25f4fceb3c18519b5b6e5de1a0a814
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVolumeInformationA
GetTempFileNameA
Sleep
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
WinExec
GetTempPathA
CopyFileA
MoveFileExA
FindResourceA
LoadResource
LockResource
FreeResource
GetComputerNameA
CreateDirectoryA
CreateProcessA
GetCommandLineA
lstrcmpiA
GetModuleHandleA
MultiByteToWideChar
GetStartupInfoA
CreateMutexA
GetTimeZoneInformation
GetFileAttributesA
DeleteFileA
LocalFree
FormatMessageA
OutputDebugStringA
GetProcAddress
LoadLibraryA
FreeLibrary
CloseHandle
TerminateProcess
WaitForSingleObject
OpenProcess
WideCharToMultiByte
HeapFree
SetLastError
HeapAlloc
DeviceIoControl
GetLastError
CreateFileA
GetShortPathNameA
GetModuleFileNameA
SetPriorityClass
GetCurrentProcess
GetVersionExA
GetSystemTime
advapi32
SetNamedSecurityInfoA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyA
iphlpapi
GetAdaptersInfo
mfc42
msvcp60
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV01@@Z
??0logic_error@std@@QAE@ABV01@@Z
??1_Winit@std@@QAE@XZ
msvcrt
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
strstr
atol
strtol
isspace
calloc
exit
_itoa
memmove
_mbscmp
mktime
gmtime
localtime
memcmp
strchr
strtoul
toupper
tolower
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
memcpy
__p__fmode
__set_app_type
_except_handler3
_controlfp
strncmp
isalnum
_snprintf
fopen
printf
fwrite
fclose
fflush
vsprintf
strrchr
strncat
_CxxThrowException
??0exception@@QAE@ABV0@@Z
malloc
memset
_vsnprintf
realloc
strcpy
strcat
free
__CxxFrameHandler
strlen
strncpy
sprintf
atoi
time
strcmp
strtok
_stricmp
fputc
fseek
ftell
rewind
__p__commode
fread
_fstat
_fileno
_unlink
_strdup
_setmbcp
ole32
OleRun
CoInitializeEx
CoInitialize
CoCreateInstance
CoUninitialize
oleacc
ObjectFromLresult
oleaut32
shell32
ShellExecuteA
SHGetSpecialFolderPathA
shlwapi
PathAppendA
SHGetValueA
PathFindExtensionA
PathRemoveExtensionA
PathFindFileNameA
PathFileExistsA
PathIsDirectoryA
SHSetValueA
PathRemoveFileSpecA
user32
GetClientRect
GetForegroundWindow
GetParent
GetClassNameA
EnumChildWindows
EnumThreadWindows
WaitForInputIdle
GetWindowTextA
SetWindowTextA
SetForegroundWindow
RegisterWindowMessageA
GetWindowThreadProcessId
SendMessageTimeoutA
EnumWindows
PostMessageA
FindWindowExA
EnableWindow
SetParent
SetTimer
wsprintfA
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
wininet
InternetOpenA
InternetSetCookieA
InternetReadFile
InternetCrackUrlA
InternetGetConnectedState
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetOpenUrlA
wsock32
WSAStartup
Sections
UPX0 Size: 484KB - Virtual size: 484KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE