Behavioral task
behavioral1
Sample
1b1d90169e210da0dae770e101d4cd94_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1b1d90169e210da0dae770e101d4cd94_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1b1d90169e210da0dae770e101d4cd94_JaffaCakes118
-
Size
256KB
-
MD5
1b1d90169e210da0dae770e101d4cd94
-
SHA1
20139e271c6f089390bf16b150b6f0b859be08d7
-
SHA256
94542a10187586344e43344bcba18927a6222a6e1f1729dc67cc5dd850197be4
-
SHA512
750833aaf5f52f315e5345c3638570a196b20ccce01f82f5f7b6ca3d4bf542443599d4cb54ff2a8b35d654970e718a64296d9acc382298cd2fe5b67781e18e00
-
SSDEEP
3072:Kbk2Tg6UVMJ6uBoURXkkPYSvMGf4O1IFpWq4Et4UIgBb3mUgO8pV3iP38Q+rplD/:KbksECZ/PzvNfx1IFpWdRavuV3QsfD
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b1d90169e210da0dae770e101d4cd94_JaffaCakes118
Files
-
1b1d90169e210da0dae770e101d4cd94_JaffaCakes118.exe windows:4 windows x86 arch:x86
8151f583ac57020c9d586d1012dbb83c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
gethostname
connect
WSAStartup
WSAGetLastError
htons
WSACleanup
recv
socket
closesocket
gethostbyname
send
kernel32
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
Sleep
GetTempPathA
LocalFree
SetErrorMode
CreateMutexA
GetProcAddress
LoadLibraryA
inseng
DownloadFile
GetICifFileFromFile
netid
ShowDcNotFoundErrorDialog
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.edata Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 3KB - Virtual size: 485KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 86KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 219KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 131KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 1KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ