Behavioral task
behavioral1
Sample
097dba4b43a6bb36dbcc826ae6e7136d_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
097dba4b43a6bb36dbcc826ae6e7136d_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
097dba4b43a6bb36dbcc826ae6e7136d_JaffaCakes118
-
Size
154KB
-
MD5
097dba4b43a6bb36dbcc826ae6e7136d
-
SHA1
1319dff7436e48a1a4558aa3ccdca88054a3ed7e
-
SHA256
8c9b7fb3407274f09ff286432cc5512889c651bdcc318323703c5a7e1044299e
-
SHA512
4b727ce3ba8ea3dfbc630fa51693e9fd4e63544aa181968a532d987a4dab31c5e9a09f036671ebb5475c2042da37322149ed3d181ae04b3128afc95dec2c0464
-
SSDEEP
3072:Yedh208jbqidoGjhdUmRS6iv+X2ZkKlAiZynUMYBVBjlR/Np1A/:bsbqIBlut2X2xf/BV/JNp1A/
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 097dba4b43a6bb36dbcc826ae6e7136d_JaffaCakes118
Files
-
097dba4b43a6bb36dbcc826ae6e7136d_JaffaCakes118.exe windows:5 windows x86 arch:x86
4f98fec5d663517cfc423bbb00c0a407
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_cexit
_XcptFilter
_initterm
_c_exit
swprintf
wcschr
_wcsnicmp
free
malloc
_wsplitpath
??2@YAPAXI@Z
??3@YAXPAX@Z
__getmainargs
_acmdln
_exit
exit
_wcsicmp
advapi32
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyW
RegSetValueExW
ImpersonateLoggedOnUser
RegOpenCurrentUser
StartServiceW
CreateProcessAsUserW
ControlService
CheckTokenMembership
DuplicateToken
DuplicateTokenEx
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
RegOpenKeyExW
RegCloseKey
ImpersonateSelf
OpenThreadToken
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
AccessCheck
RevertToSelf
GetUserNameW
CopySid
GetLengthSid
GetTokenInformation
AllocateAndInitializeSid
FreeSid
kernel32
LoadLibraryW
GetExitCodeProcess
lstrcmpW
CreateFileW
SetErrorMode
OpenMutexW
SetEvent
OpenEventW
SetCurrentDirectoryW
lstrcpyW
GetCommandLineW
GetModuleHandleA
GetStartupInfoA
LocalFree
OpenProcess
lstrcatW
TerminateProcess
CreateProcessW
GetProcessVersion
lstrlenW
SetLastError
GetFileAttributesW
GetModuleFileNameW
GetSystemDirectoryW
lstrcmpiW
GetProcAddress
GetCurrentThreadId
Sleep
CreateEventW
CreateFileMappingW
CloseHandle
MapViewOfFile
OpenFileMappingW
UnmapViewOfFile
GetLastError
GetCurrentThread
GetCurrentProcessId
ProcessIdToSessionId
LocalAlloc
FreeLibrary
user32
DispatchMessageW
SetTimer
MsgWaitForMultipleObjects
TranslateMessage
PeekMessageW
DefWindowProcW
MessageBoxW
FindWindowExW
RegisterClassW
CreateWindowExW
DestroyWindow
KillTimer
SetProcessWindowStation
OpenWindowStationW
GetProcessWindowStation
CloseWindowStation
CloseDesktop
GetUserObjectInformationW
OpenDesktopW
OpenInputDesktop
SetThreadDesktop
GetThreadDesktop
PostMessageW
GetWindowThreadProcessId
EnumWindows
PostThreadMessageW
RegisterWindowMessageW
LoadStringW
netapi32
NetUserGetInfo
NetApiBufferFree
psapi
EnumProcesses
GetModuleBaseNameW
EnumProcessModules
ole32
CoUninitialize
CoCreateInstance
CoInitialize
ntdll
NtDuplicateToken
NtClose
winsta
WinStationQueryInformationW
rpcrt4
RpcBindingFree
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
NdrClientCall2
Sections
.text Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE