Behavioral task
behavioral1
Sample
2334ab82f01783b5eb23a96a1bd93faf_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2334ab82f01783b5eb23a96a1bd93faf_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
2334ab82f01783b5eb23a96a1bd93faf_JaffaCakes118
-
Size
329KB
-
MD5
2334ab82f01783b5eb23a96a1bd93faf
-
SHA1
f39d244fd7e4eb0226ad23644d653f0640fdfcca
-
SHA256
ce60f12deb30e86b2d38bd714c4b290552d628952e0ef882e967b94a602fc361
-
SHA512
736f7d7327205c82642a57c0d0d1f850f31840f5ed4c7206c08dbbc01074e9813df5f5b4a54aa3435d9b54773ed78a660580d2bca040b434c979b159d580a30e
-
SSDEEP
3072:l8rny4dYfcCSA4dx31kdt5dfJYgmsH/GnCHNwWruf1dUbvppylJ/D4/R57l9R9Cl:/cCSq7/Hu28YvpaDuBllQ9xbp/f
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2334ab82f01783b5eb23a96a1bd93faf_JaffaCakes118
Files
-
2334ab82f01783b5eb23a96a1bd93faf_JaffaCakes118.exe windows:4 windows x86 arch:x86
2260533c50c1610efba8f923cef18e19
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
Sleep
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
WriteFile
WinExec
WaitForSingleObject
VirtualQuery
Sleep
SetFilePointer
SetEvent
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
MultiByteToWideChar
MoveFileA
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalReAlloc
GlobalHandle
GlobalLock
GlobalFree
GlobalAlloc
GetVersionExA
GetTimeZoneInformation
GetThreadLocale
GetTempPathA
GetTempFileNameA
GetStringTypeExA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetExitCodeThread
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCPInfo
GetACP
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateFileA
CreateEventA
CompareStringA
CloseHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
SetCurrentDirectoryA
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCurrentDirectoryA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegFlushKey
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
iphlpapi
GetNetworkParams
ole32
CoUninitialize
CoInitialize
oleaut32
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
GetErrorInfo
SysFreeString
SysFreeString
SysReAllocStringLen
SysAllocStringLen
user32
CreateWindowExA
UpdateWindow
TranslateMessage
RegisterClassA
PeekMessageA
MsgWaitForMultipleObjects
MessageBoxA
LoadStringA
LoadCursorA
GetSystemMetrics
GetMessageA
DispatchMessageA
DestroyWindow
DefWindowProcA
CharNextA
CharUpperBuffA
CharToOemA
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
wininet
InternetGetConnectedState
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
wsock32
WSACleanup
WSAStartup
Sections
UPX0 Size: 320KB - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE