Behavioral task
behavioral1
Sample
069f4f59c6df4c2c6f1410afc164330e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
069f4f59c6df4c2c6f1410afc164330e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
069f4f59c6df4c2c6f1410afc164330e_JaffaCakes118
-
Size
55KB
-
MD5
069f4f59c6df4c2c6f1410afc164330e
-
SHA1
2bd191a8ac4b71382171c702c626db36a9ed5046
-
SHA256
19315b939e090d06f2f173f14125f1ce7e30472baef175b187b97a1ffd68512b
-
SHA512
9aa4388163915e00c60a947adfaaa8e09844bb95f96a3ba16dfbb34a66ddc10d7e6a4e147851b33d3f0993720949942d4197df1445ce4085734ca77ea95d24f8
-
SSDEEP
384:HHF7LXVWT6RZlQa5mG/U1DZE3outUYZxoZDAJpb4/PrH7863BfOODS+4sHaXX:F/3IiU1DmocU4xGKV4H7R39Q+4s6XX
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 069f4f59c6df4c2c6f1410afc164330e_JaffaCakes118
Files
-
069f4f59c6df4c2c6f1410afc164330e_JaffaCakes118.exe windows:4 windows x86 arch:x86
0169f580b0dd636ff5e309be6b2fc4a0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
lstrlenA
lstrcmpiA
WritePrivateProfileStringA
WriteFile
SizeofResource
SetFilePointer
SetFileAttributesA
SetEndOfFile
ReadFile
MoveFileExA
LockResource
LoadResource
LoadLibraryA
GetVersionExA
GetSystemDirectoryA
GetShortPathNameA
GetProcAddress
GetModuleFileNameA
GetFileSize
FreeResource
FreeLibrary
FindResourceA
DeleteFileA
CreateFileA
CopyFileA
CloseHandle
GetCurrentThreadId
ExitProcess
RtlUnwind
RaiseException
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
advapi32
RegSetValueExA
RegCreateKeyExA
RegCloseKey
shlwapi
PathFileExistsA
user32
LoadImageA
IsWindow
IsCharAlphaA
GetMessageA
FindWindowA
DispatchMessageA
CreateWindowExA
Sections
UPX0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE