Behavioral task
behavioral1
Sample
1a3d918da9d4187e40b09da47da7f04b_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1a3d918da9d4187e40b09da47da7f04b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1a3d918da9d4187e40b09da47da7f04b_JaffaCakes118
-
Size
200KB
-
MD5
1a3d918da9d4187e40b09da47da7f04b
-
SHA1
4da8a5cf14c3f728cd7585f60f2405fe0605ec46
-
SHA256
a87e7a64fab14a905bcd90c56a5e46667ad537c75b7d5e8bcf6e5911a2cf3305
-
SHA512
a8f0d2775b45bb3f47c1352aa3c35909764868ed1102794325918ede6d2c0c16792dff54b61c3bb004bc354b78b0683e36814dc813150d45ff7cd2bdfd6dbd50
-
SSDEEP
3072:jQ9BjMkwtE5yms7yVR69+uZU3fodHkUoghWeQplZe2H2+agw4SY3nm4lO5x6hvc:jQ9qkwtE5s469+kjH6lRZeM0qmXx2c
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a3d918da9d4187e40b09da47da7f04b_JaffaCakes118
Files
-
1a3d918da9d4187e40b09da47da7f04b_JaffaCakes118.exe windows:4 windows x86 arch:x86
8276b60205aa760ac713ab439ae2fcd6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FileTimeToDosDateTime
ReadFile
SetConsoleMode
GetConsoleMode
LeaveCriticalSection
HeapFree
GetFileTime
GetProcessHeap
EnterCriticalSection
lstrcpynA
lstrcmpiA
lstrlenA
InitializeCriticalSection
ReleaseMutex
WaitForSingleObject
InterlockedExchange
CreateMutexA
HeapAlloc
GetCurrentProcess
SetConsoleCtrlHandler
MultiByteToWideChar
ExitProcess
TerminateProcess
GetCommandLineA
UnhandledExceptionFilter
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
GetStdHandle
GetFileAttributesA
VirtualFree
VirtualAlloc
HeapReAlloc
GetTimeZoneInformation
GetFileType
GetStartupInfoA
GetACP
GetOEMCP
FlushFileBuffers
WriteFile
SetFilePointer
WideCharToMultiByte
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
RtlUnwind
SetStdHandle
GetProcAddress
LoadLibraryA
GetLocaleInfoW
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetDriveTypeA
SetVolumeLabelA
GetFullPathNameA
GetVolumeInformationA
FileTimeToLocalFileTime
CreateFileA
SetFileAttributesA
GetLastError
SetFileTime
CloseHandle
GetVersion
HeapCreate
HeapDestroy
SetHandleCount
FindClose
GetCurrentDirectoryA
DeleteFileA
CreateDirectoryA
FindFirstFileA
FileTimeToSystemTime
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSecurityDescriptorControl
GetKernelObjectSecurity
SetKernelObjectSecurity
IsValidSecurityDescriptor
GetSecurityDescriptorLength
user32
CharToOemA
OemToCharA
Sections
.text Size: 68KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE