Behavioral task
behavioral1
Sample
052e8fc02b9a292f5076c099b99ff122_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
052e8fc02b9a292f5076c099b99ff122_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
052e8fc02b9a292f5076c099b99ff122_JaffaCakes118
-
Size
47KB
-
MD5
052e8fc02b9a292f5076c099b99ff122
-
SHA1
b7e997450a9490a0c8e78708c21875bcfe328e51
-
SHA256
ca385959bac09123780aca76a514685fd1ffe56dad2e363ac3727643105c24a6
-
SHA512
952f992cee68f29d1dafb754df1da23833629d54316280b70e0254cbd5b3a226127e578ff09daa08b3f26f79439f0371d113cc6c4ce811d7d8ff5e6d3d5eaab8
-
SSDEEP
384:FSFRdCyDMqlWYmQ2yNRZcz6hF3GBlooqs8petpIDmxL2:+CyIqlZmQd/BSBlvxIyx2
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 052e8fc02b9a292f5076c099b99ff122_JaffaCakes118
Files
-
052e8fc02b9a292f5076c099b99ff122_JaffaCakes118.exe windows:4 windows x86 arch:x86
91432e7e2c78c6fe00dea968d67dda47
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WriteFile
WinExec
WaitForSingleObject
Sleep
SetFilePointer
SetFileAttributesA
ReadFile
OpenProcess
GetTempPathA
GetTempFileNameA
GetSystemDirectoryA
GetShortPathNameA
GetModuleFileNameA
GetCurrentProcessId
FindFirstFileA
FindClose
DeleteFileA
CreateProcessA
CreateFileA
CopyFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
user32
GetKeyboardType
MessageBoxA
CharNextA
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
Sections
UPX0 Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE