Behavioral task
behavioral1
Sample
1a1f0adb3d7ae13f288bafc3c7705566_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1a1f0adb3d7ae13f288bafc3c7705566_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1a1f0adb3d7ae13f288bafc3c7705566_JaffaCakes118
-
Size
160KB
-
MD5
1a1f0adb3d7ae13f288bafc3c7705566
-
SHA1
7b0c48d238c425a630f0c82d0d3af6f1ec16877d
-
SHA256
1680f3d0fcb7306b8e2425606263b0b48090628901cb9443687a97a8506e2887
-
SHA512
4c3f54e8374764c4f61b89cdbb7cb6722dbd1c0bd9dfee55f79fb9073d8d6da8c5d983784851b77746e9174ea6d77351550b8335a346efd553085f27fd967575
-
SSDEEP
3072:lLtXR9lJCBlgwuQOJbmNh7MMGdl9oFGKbIq2T2FB+Hk6CmJsk:lLtGBFFS9oFGKbIq2KFBeJt
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a1f0adb3d7ae13f288bafc3c7705566_JaffaCakes118
Files
-
1a1f0adb3d7ae13f288bafc3c7705566_JaffaCakes118.exe windows:4 windows x86 arch:x86
b3f535b4d66fde533c9d140c16c5650e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
comctl32
ord17
elbycdio
CloakCDR_SendCommand
ElbyCDIO_InitScsi
ElbyCDIO_GetOSVersion
kernel32
LoadLibraryA
GetDriveTypeA
CloseHandle
lstrcatA
lstrcpyA
lstrlenA
GetModuleFileNameA
GetLastError
CreateEventA
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
WideCharToMultiByte
lstrcmpiA
QueryPerformanceCounter
GetProcAddress
SetEndOfFile
VirtualQuery
InterlockedExchange
RtlUnwind
GetCPInfo
GetOEMCP
GetACP
CreateFileA
SetFilePointer
FlushFileBuffers
SetStdHandle
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
HeapSize
FreeLibrary
GetTickCount
GetStringTypeW
GetSystemInfo
GetLocaleInfoA
VirtualProtect
GetCurrentThreadId
WriteFile
GetCurrentProcess
TerminateProcess
HeapAlloc
HeapFree
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ReadFile
ExitProcess
user32
GetMessageA
TranslateMessage
DispatchMessageA
LoadIconA
LoadCursorA
RegisterClassExA
DestroyWindow
PostQuitMessage
RegisterWindowMessageA
DeleteMenu
GetMenuState
MessageBoxA
GetCursorPos
DefWindowProcA
EnableMenuItem
SetForegroundWindow
TrackPopupMenu
PostMessageA
DestroyIcon
GetMenuItemInfoA
SetMenuItemInfoA
ModifyMenuA
LoadImageA
GetMenu
GetSubMenu
CheckMenuItem
CreateWindowExA
wsprintfA
gdi32
GetStockObject
advapi32
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
shell32
ShellExecuteA
Shell_NotifyIconA
Sections
.text Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 104KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE