Behavioral task
behavioral1
Sample
196a4c61474730abd4a610a5f6a07ea0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
196a4c61474730abd4a610a5f6a07ea0_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
196a4c61474730abd4a610a5f6a07ea0_JaffaCakes118
-
Size
27KB
-
MD5
196a4c61474730abd4a610a5f6a07ea0
-
SHA1
adf353ce9a8156ed244eea67f891c677ba6d7a01
-
SHA256
17394818c8e2b6a3e03e772e21854be0806533d61944fceda9c6fa173eaa7fe3
-
SHA512
85860553a5d55660fe8f9664bcc786b00d0ba4d5936262ce996c6c69a49d0d357504ee6594ec5006dbfb31e41b028c7ae124ced80c66032d267488942d59c0e0
-
SSDEEP
384:n3D2VAJUNUl/Fhc6SsZ6ZFmygyKSdBfijRs:nTpJLNhcXsZN0dh8s
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 196a4c61474730abd4a610a5f6a07ea0_JaffaCakes118
Files
-
196a4c61474730abd4a610a5f6a07ea0_JaffaCakes118.exe windows:4 windows x86 arch:x86
8dea6042e77d96d4d601edf5b4e7d5a2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
CopyFileA
DeleteFileA
CreateFileA
GetSystemDirectoryA
Process32First
CreateToolhelp32Snapshot
FreeResource
OpenEventA
LockResource
LoadResource
SizeofResource
FindResourceA
ReadFile
VirtualAlloc
ExitProcess
WaitForSingleObject
CreateEventA
GetProcAddress
SetEvent
CloseHandle
GetLastError
GetModuleHandleA
WriteFile
GetStartupInfoA
advapi32
CreateServiceA
DeleteService
ControlService
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
msvcrt
strcpy
memcmp
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strcat
_stricmp
_strlwr
Sections
UPX0 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE