Behavioral task
behavioral1
Sample
fd70f8c2ee031260a673e740428b16b2_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
fd70f8c2ee031260a673e740428b16b2_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fd70f8c2ee031260a673e740428b16b2_JaffaCakes118
-
Size
53KB
-
MD5
fd70f8c2ee031260a673e740428b16b2
-
SHA1
5604d84a4f4e42119c7b8bebcf818b5262cce3c2
-
SHA256
76dc008b1382586d3d622244178ead6e03035113e4c1619ce04c1712a2cf1073
-
SHA512
f367bf6928c0118f65f50a8f8fdb74ed2788195c1f5d6d3343cf60a4ce265538cf737a48e366afec8f8d0320a825f530fe689e09cdb4a395ed3fd8252cef9d2d
-
SSDEEP
768:xPerS9iyHyC85bGYcxhisRP2Jt0DDA3QFLwvkM8ek:xPerS9BHyCDYcxh5RPACs3QVmP8ek
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd70f8c2ee031260a673e740428b16b2_JaffaCakes118
Files
-
fd70f8c2ee031260a673e740428b16b2_JaffaCakes118.exe windows:4 windows x86 arch:x86
ffd5c70eed17f7a0f505886c4d80c329
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
GetVersionExA
GetProcessHeap
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
TlsAlloc
GetLastError
Sleep
GetStartupInfoA
GetModuleFileNameA
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSection
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetProcAddress
msasn1
ASN1ztcharstring_free
ASN1BEREncDouble
ASN1char32string_cmp
ASN1BERDecZeroChar32String
ASN1EncSetError
ASN1CEREncBitString
ASN1BERDecCharString
ASN1bitstring_cmp
ASN1_FreeEncoded
ASN1CEREncZeroMultibyteString
ASN1octetstring_cmp
ASN1_SetEncoderOption
ASN1BEREncRemoveZeroBits
mapi32
MAPIDetails
BMAPIResolveName
MAPILogonEx
cmc_list
MAPISendDocuments
LAUNCHWIZARD
ScMAPIXFromCMC
Sections
UPX1 Size: 1024B - Virtual size: 683B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bHD Size: 2KB - Virtual size: 309KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.HyRU Size: 3KB - Virtual size: 778KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 6KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nu Size: 4KB - Virtual size: 201KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 6KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hkqb Size: 3KB - Virtual size: 474KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.u Size: 1024B - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ