Behavioral task
behavioral1
Sample
2293e7bf4a4f2a20485f6f47869eedec_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2293e7bf4a4f2a20485f6f47869eedec_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2293e7bf4a4f2a20485f6f47869eedec_JaffaCakes118
-
Size
246KB
-
MD5
2293e7bf4a4f2a20485f6f47869eedec
-
SHA1
92a71a8096e7d3931835e7f7906527239caef5b5
-
SHA256
1f775b1b363099769a893f51212ddd817a008bf4ad2586851f2807e741d4659a
-
SHA512
5ee408b69320c8cb2edb36614877209f08513fcb7bcdb51e0ac6592fec56f6dbc1bcb83e931aa6842c6681006a134041f997f472378cba9d465e5d7374d268ae
-
SSDEEP
6144:ueEUq3/sSzA7pfXG7m9ln3T4Y9qd4yqUTJ7nTti:2M7p0mnn3kYYdeUTtpi
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2293e7bf4a4f2a20485f6f47869eedec_JaffaCakes118
Files
-
2293e7bf4a4f2a20485f6f47869eedec_JaffaCakes118.exe windows:4 windows x86 arch:x86
b58b33fee3515f8f9be18210cf425a28
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
GlobalAlloc
CreateEventW
OpenEventW
GetCurrentProcessId
CreateSemaphoreW
GetSystemTime
GetModuleFileNameW
GetProcessHeap
HeapCreate
lstrlenA
ExitProcess
GetShortPathNameA
GetModuleFileNameA
MultiByteToWideChar
CreateMutexW
FreeLibrary
LoadLibraryW
GetSystemInfo
GetVersionExA
ExpandEnvironmentStringsW
CreateDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemDirectoryW
LoadLibraryA
GetVolumeInformationW
LocalFree
WaitForMultipleObjects
OpenEventA
GetLastError
GetFileAttributesW
Sleep
InitializeCriticalSection
GetCurrentThread
GetTickCount
SetEvent
WaitForSingleObject
GetCurrentProcess
lstrcpynA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetStartupInfoA
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
GetEnvironmentStringsW
BeginUpdateResourceW
GetProcAddress
user32
CharPrevA
CharUpperA
advapi32
AccessCheck
RegSetValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsA
GetTraceLoggerHandle
GetTraceEnableFlags
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
ReportEventW
DeregisterEventSource
RegisterEventSourceW
DuplicateToken
RevertToSelf
ImpersonateLoggedOnUser
AdjustTokenPrivileges
GetNamedSecurityInfoW
LookupPrivilegeValueA
MapGenericMask
TraceMessage
OpenThreadToken
OpenProcessToken
rpcrt4
RpcServerRegisterIf
RpcServerListen
RpcMgmtStopServerListening
RpcImpersonateClient
RpcServerUnregisterIf
RpcRevertToSelf
RpcServerUseProtseqEpA
NdrServerCall2
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
inseng
DownloadFile
DllGetClassObject
mf3216
Mf3216DllInitialize
Sections
.text Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 102KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 115KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ