Behavioral task
behavioral1
Sample
00d9b3be3e567776edd90c576008f527_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
00d9b3be3e567776edd90c576008f527_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
00d9b3be3e567776edd90c576008f527_JaffaCakes118
-
Size
120KB
-
MD5
00d9b3be3e567776edd90c576008f527
-
SHA1
417e4d9ef8017c49415fe0f56be14d25b21f7414
-
SHA256
e74a1bd92ac5729d6eee29ae23ae50f896942392b4f0f5bc6117e74dc7d08148
-
SHA512
2f29f36a9823db48ab5926704e2a448435a809f9c156403154146bef66a1ffe8c42bc71c4613d5cd37c40b8ea81220b5cbffd40789eba13234a2727eb6fc0457
-
SSDEEP
1536:skIsEHSnD3iLajvRFNlM616dn712RzqqKdsh/KhaALTYV0sTwyb:skRv7iLa7RvlMyinoVqqoEJ2TdsTw+
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00d9b3be3e567776edd90c576008f527_JaffaCakes118
Files
-
00d9b3be3e567776edd90c576008f527_JaffaCakes118.exe windows:4 windows x86 arch:x86
ce0238ddf26fa4ccf0af875c27c16599
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
LookupPrivilegeValueA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenSCManagerA
OpenServiceA
CreateServiceA
CloseServiceHandle
ChangeServiceConfigA
ChangeServiceConfig2A
StartServiceA
OpenProcessToken
AdjustTokenPrivileges
kernel32
Sleep
CreateFileA
MoveFileA
CopyFileA
TerminateProcess
GetLastError
OpenProcess
SetFileAttributesA
CloseHandle
GetCurrentProcessId
Process32First
CreateToolhelp32Snapshot
WinExec
WriteFile
lstrcpy
GetCommandLineA
GetStartupInfoA
CreateProcessA
DeleteFileA
GetSystemTime
GetWindowsDirectoryA
GetModuleFileNameA
GetCurrentProcess
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemDirectoryA
lstrcat
Process32Next
GetModuleHandleA
ExitProcess
HeapFree
ReadFile
HeapAlloc
GetProcessHeap
GetFileSize
GetLocalTime
lstrlen
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
lstrcmpi
psapi
GetModuleFileNameExA
user32
wsprintfA
CharUpperBuffA
MessageBoxA
Sections
UPX0 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mackt Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE