Behavioral task
behavioral1
Sample
1bdcf86b7122ba979583c3799aa28f00_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1bdcf86b7122ba979583c3799aa28f00_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1bdcf86b7122ba979583c3799aa28f00_JaffaCakes118
-
Size
224KB
-
MD5
1bdcf86b7122ba979583c3799aa28f00
-
SHA1
b5f80b6416d8914b2f5354b64300e52da3664ba3
-
SHA256
a66801e8bd4b3da330050d15fc35317b5092d1c489dc5c6a9d6e49ce9f451beb
-
SHA512
bd3af4f446dd31fcc16c6bbaa70067270cde2f14dbff87b93cd1b527af1e02e80f58f647851d3cbce1e62023084d0817a4945e404a6a2d2fd36912dd7a20cc6c
-
SSDEEP
6144:VHeuSUAoYosjcGzRjlXo1nQ4ESAj1AnVwOV3uZi8Zm:VHe7UUjXzFjS1nVf3uTU
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1bdcf86b7122ba979583c3799aa28f00_JaffaCakes118
Files
-
1bdcf86b7122ba979583c3799aa28f00_JaffaCakes118.exe windows:5 windows x86 arch:x86
f433e7fcc51e68080022754836705744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
LoadLibraryA
GetProcAddress
ExitProcess
VirtualAlloc
VirtualFree
user32
MessageBoxA
Sections
UPX0 Size: - Virtual size: 552KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
r2w1aydl Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ixy2nvhb Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fzrlib0r Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
n.fvstw5 Size: 221KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ci48p600 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ