Behavioral task
behavioral1
Sample
23691b41cc844c8f288f406144fab73e_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
23691b41cc844c8f288f406144fab73e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
23691b41cc844c8f288f406144fab73e_JaffaCakes118
-
Size
64KB
-
MD5
23691b41cc844c8f288f406144fab73e
-
SHA1
de063616a7844ba2c7f5106176dc9353f5adebe6
-
SHA256
da4c8e4d5394c85117c477663cd4332529ceedc0773af13df8edda8bd0e3a4c8
-
SHA512
2a1a2c9ab19a3c8f724288d2175bf6b8474de1e402d941a89e1f4388040df113e6e4ad2d48ffead6e9e9a6ef978ab74dd2a2d7c7b242f887ecb646b9fead82b0
-
SSDEEP
1536:R8ITrvUb94WvWInSWqeP01QU+7C7WAdg44wmJs3+xpxj:R8ITrvUblHSWqCOQUl7WAdsbJy+/x
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23691b41cc844c8f288f406144fab73e_JaffaCakes118
Files
-
23691b41cc844c8f288f406144fab73e_JaffaCakes118.exe windows:5 windows x86 arch:x86
f03f8241b92a33171f7da41d7077dae5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempFileNameA
SetEnvironmentVariableA
CreateProcessA
CloseHandle
VerLanguageNameA
GetVolumeInformationA
GlobalAlloc
ReadFile
GetTempPathA
GetPriorityClass
GetWindowsDirectoryA
GetTickCount
WaitForSingleObject
GetQueuedCompletionStatus
_lwrite
SystemTimeToFileTime
LocalCompact
GetModuleFileNameA
OpenFile
VirtualProtect
user32
DdeInitializeA
wsprintfA
GetMenuCheckMarkDimensions
ShowCaret
CharUpperBuffW
ValidateRect
MessageBoxExA
ClipCursor
GetMenu
GetIconInfo
GetSystemMenu
gdi32
SetPolyFillMode
SetWinMetaFileBits
RealizePalette
EndPath
SetEnhMetaFileBits
PolyTextOutW
GetMetaFileBitsEx
EnumFontFamiliesW
GetTextMetricsA
SetTextJustification
CreateICW
ws2_32
htonl
WSAStartup
connect
htons
bind
socket
closesocket
gethostbyname
send
recv
shlwapi
StrStrIA
iphlpapi
GetAdaptersInfo
msvcrt
memset
memcpy
Sections
.text Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 376B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.UPX2 Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ