Behavioral task
behavioral1
Sample
26e68ae6a31a9134c3e21ac7a596e6d3_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
26e68ae6a31a9134c3e21ac7a596e6d3_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
26e68ae6a31a9134c3e21ac7a596e6d3_JaffaCakes118
-
Size
200KB
-
MD5
26e68ae6a31a9134c3e21ac7a596e6d3
-
SHA1
34251116a296ba0e479d06b0b5598983988a6d24
-
SHA256
db36e2d2647a3aa790a998fb690789cf14957a42ced9e76ba75d3f84bd722f09
-
SHA512
82b28e4264baed93d8b708318743ed1c404178eef5256e687fe61ea3a64301078487bbf7204f56c796edb17124aea16ddc3d9e7448442cab703315db3569447e
-
SSDEEP
6144:dR7weNAiCcHFXIx6VhEmS9WDKSEdjU+Vk:dRkJiCcHF4x6kmdS
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26e68ae6a31a9134c3e21ac7a596e6d3_JaffaCakes118
Files
-
26e68ae6a31a9134c3e21ac7a596e6d3_JaffaCakes118.exe windows:4 windows x86 arch:x86
e3a42854c6fe21401754b6822184ff84
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnterCriticalSection
CreateEventA
SetEvent
Sleep
LeaveCriticalSection
FindFirstFileA
FindClose
WaitForSingleObject
GetVersionExA
WriteFile
GetLocalTime
SetFilePointer
ReleaseMutex
CreateMutexA
lstrcatA
InterlockedIncrement
DeleteCriticalSection
GetProcAddress
lstrcpyA
LoadLibraryA
lstrcpynA
InitializeCriticalSection
IsDBCSLeadByte
FindResourceA
LoadLibraryExA
GetLastError
FreeLibrary
LoadResource
SizeofResource
GetModuleHandleA
WideCharToMultiByte
GetModuleFileNameA
lstrlenW
GetShortPathNameA
MultiByteToWideChar
lstrcmpiA
lstrlenA
GetCommandLineA
CreateFileA
GetCurrentThreadId
InterlockedDecrement
GlobalFree
DeviceIoControl
GlobalAlloc
GetCurrentProcess
CloseHandle
GetCurrentThread
GetStartupInfoA
user32
wsprintfA
GetMessageA
DispatchMessageA
LoadStringA
CharNextA
MessageBoxA
PostThreadMessageA
advapi32
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
CopySid
InitializeSecurityDescriptor
GetLengthSid
RegEnumValueA
RegQueryInfoKeyA
SetSecurityDescriptorDacl
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegDeleteValueA
StartServiceCtrlDispatcherA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegisterServiceCtrlHandlerA
RegisterEventSourceA
SetServiceStatus
DeregisterEventSource
RevertToSelf
ReportEventA
EqualSid
AllocateAndInitializeSid
FreeSid
OpenThreadToken
OpenProcessToken
GetTokenInformation
LockServiceDatabase
UnlockServiceDatabase
CloseServiceHandle
CreateServiceA
DeleteService
OpenServiceA
ControlService
OpenSCManagerA
ole32
CoRegisterClassObject
CoCreateFreeThreadedMarshaler
CoInitializeSecurity
CoUninitialize
CoImpersonateClient
CoRevokeClassObject
CoCreateInstance
CoTaskMemFree
CoInitialize
CoTaskMemRealloc
CoTaskMemAlloc
oleaut32
RegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
VarUI4FromStr
msvcrt
malloc
free
vsprintf
??3@YAXPAX@Z
wcslen
realloc
strlen
_wsplitpath
_splitpath
rename
_stat
_unlink
swprintf
puts
_CxxThrowException
_onexit
_except_handler3
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
memset
memcpy
__CxxFrameHandler
??1type_info@@UAE@XZ
??2@YAPAXI@Z
memcmp
__dllonexit
msvcp60
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?_Xran@std@@YAXXZ
?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHABV12@@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIPBGI@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
Sections
.text Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE