Behavioral task
behavioral1
Sample
0ec4460c4f2fef7afe9bc501ff566367_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0ec4460c4f2fef7afe9bc501ff566367_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0ec4460c4f2fef7afe9bc501ff566367_JaffaCakes118
-
Size
440KB
-
MD5
0ec4460c4f2fef7afe9bc501ff566367
-
SHA1
3bac1d6ce9cd5b591d4eb3c9984b0799519a0d73
-
SHA256
b5d16923ef4635a7659b8129a7a67754d2130560cd235b49c2c63ceef8fdd80d
-
SHA512
9176830c54489a0219228160bb5ddaf18390477d5a6bf6730b17cd5317ced6e3bc959da3afadcddb8dcc8dee024e0dc6130f16a47987a8d423b3a80045e16a8d
-
SSDEEP
6144:5/ktRdRMFcHgDiIun3dwLNnT9AOJHUWGjKQ2HQ2J+c98wNUyKxhnL88fo:FsXRMFxiIun34RAzX2w2J+s8r9LRg
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ec4460c4f2fef7afe9bc501ff566367_JaffaCakes118
Files
-
0ec4460c4f2fef7afe9bc501ff566367_JaffaCakes118.exe windows:4 windows x86 arch:x86
3482bc029cf37d736bfe0ef627fe6a61
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileAttributesA
GetCurrentProcess
GetVersionExA
GetModuleFileNameA
HeapReAlloc
CompareStringW
CompareStringA
FlushFileBuffers
GetStringTypeW
SetFileAttributesA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
GetOEMCP
GetACP
GetCPInfo
GetCurrentProcessId
GetVolumeInformationA
lstrlenA
GetLastError
FreeLibrary
LoadLibraryA
GetProcAddress
GetProcessHeap
HeapAlloc
GetStringTypeA
HeapFree
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
GetStdHandle
SetHandleCount
SetStdHandle
WriteFile
CloseHandle
GetFileType
CreateFileA
InterlockedDecrement
InterlockedIncrement
FindFirstFileA
FindNextFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
SetFilePointer
ReadFile
GetTimeZoneInformation
GetSystemTime
GetLocalTime
ExitProcess
TerminateProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
VirtualFree
VirtualAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableA
HeapDestroy
HeapCreate
RtlUnwind
SetEnvironmentVariableA
advapi32
OpenProcessToken
GetTokenInformation
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
AllocateAndInitializeSid
GetLengthSid
AddAce
IsValidSecurityDescriptor
RegQueryValueExA
InitializeSecurityDescriptor
user32
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
LoadStringA
RegisterClassExA
LoadCursorA
LoadIconA
SendMessageA
UpdateWindow
ShowWindow
CreateWindowExA
PostQuitMessage
EndPaint
SetTimer
DefWindowProcA
DestroyWindow
BeginPaint
ws2_32
Sections
UPX0 Size: 412KB - Virtual size: 412KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE