Behavioral task
behavioral1
Sample
199d7b39c6d3848289c07c33e8db92e1_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
199d7b39c6d3848289c07c33e8db92e1_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
199d7b39c6d3848289c07c33e8db92e1_JaffaCakes118
-
Size
259KB
-
MD5
199d7b39c6d3848289c07c33e8db92e1
-
SHA1
79d64d49086da8e5b0706707f83359c12209a714
-
SHA256
8c14b8702a4b1a307781e8638759a88313c272eb3e0813d6e5ab0937b58f4000
-
SHA512
fcb578617bad8f4a656532749f73f671871f069dd67f3216b5e30e275126a781135bb6a2d449871fedb59a1c6dacb47f828a57c5477b7363c21ec3342ba7c483
-
SSDEEP
6144:XDiE2YtrXzDLMs+n51KD8TQuZVo9UhfrFkEJ3d4dmN0Fa:n2WLLs51T8ZUMUd4KH
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 199d7b39c6d3848289c07c33e8db92e1_JaffaCakes118
Files
-
199d7b39c6d3848289c07c33e8db92e1_JaffaCakes118.exe windows:4 windows x86 arch:x86
08300f7b205cb3035a9713557135d202
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetLastError
GetTickCount
GetCurrentProcess
MultiByteToWideChar
GetSystemDirectoryW
GetVersionExA
GetProcessHeap
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
HeapCreate
ExitProcess
GetModuleFileNameA
GetEnvironmentStringsW
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
GetLocalTime
GetProcAddress
user32
GetSystemMetrics
GetMenuState
GetForegroundWindow
IsIconic
GetDesktopWindow
CreateDialogParamW
GetMenuItemID
GetActiveWindow
CharLowerA
LoadBitmapA
SetWindowRgn
DialogBoxIndirectParamW
ShowWindow
keybd_event
GetClassInfoExA
MoveWindow
GetCapture
UnregisterClassA
RegisterClassExA
GetTopWindow
MonitorFromRect
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
usp10
ScriptGetGlyphABCWidth
UspFreeMem
ScriptXtoCP
ScriptStringXtoCP
ScriptCPtoX
ScriptStringAnalyse
ScriptJustify
ScriptLayout
ScriptGetCMap
gdi32
SetWinMetaFileBits
SetEnhMetaFileBits
CreateBitmap
CreateICW
RemoveFontResourceA
GetMetaFileW
RemoveFontResourceExA
UpdateICMRegKeyA
StretchDIBits
tapisrv
ServiceMain
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 3KB - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 5KB - Virtual size: 303KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 77KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX1 Size: 1KB - Virtual size: 338KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 141KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ