Behavioral task
behavioral1
Sample
2988f8fd2346dd29d5ca20ce52c063fa_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2988f8fd2346dd29d5ca20ce52c063fa_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2988f8fd2346dd29d5ca20ce52c063fa_JaffaCakes118
-
Size
258KB
-
MD5
2988f8fd2346dd29d5ca20ce52c063fa
-
SHA1
14361030c8c5499d4b654cc878b17975caa139c7
-
SHA256
d0557a7671e5e6bec0f559859b930f0e02982eba03fe9c4877e51648259e96f1
-
SHA512
10e5c1508822912df6de1bd9465d68bab41a766fb1a4a20cff20b6ce9dcf4aa2ade89ed1ae4d1e2f67791c76d448b1d7a8e235b355e968ccf9d172bb4f327935
-
SSDEEP
6144:qAZjhKOftnMxuemFT+M+fHFsBu5tiJ1cZaoO5yFB0kOrFpfWx:1gmtnM+l+bdbtiJ1cDO5G0rWx
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2988f8fd2346dd29d5ca20ce52c063fa_JaffaCakes118
Files
-
2988f8fd2346dd29d5ca20ce52c063fa_JaffaCakes118.exe windows:4 windows x86 arch:x86
adbb1fa61b9098e1109d70c4ea1c5f07
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
Sleep
GetFileAttributesW
GetVersion
GetLogicalDriveStringsW
FindResourceW
GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
lstrcpynA
lstrlenA
GetLastError
GetFullPathNameA
GetFileAttributesA
lstrcpynW
lstrlenW
GetModuleHandleW
LoadLibraryW
FreeLibrary
GetCurrentProcess
MultiByteToWideChar
GetCurrentThread
GetTickCount
CreateDirectoryW
SystemTimeToFileTime
GetThreadPriority
GetSystemTime
InitializeCriticalSection
BeginUpdateResourceW
GetProcAddress
LoadLibraryA
user32
SetTimer
advapi32
AllocateAndInitializeSid
RegEnumKeyExW
RegDeleteValueW
RegEnumKeyW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RevertToSelf
OpenProcessToken
FreeSid
EqualSid
GetTokenInformation
RegDeleteKeyW
RegDeleteKeyA
SetThreadToken
DuplicateToken
OpenThreadToken
shell32
SHGetDesktopFolder
mssip32
CryptSIPVerifyIndirectData
CryptSIPCreateIndirectData
ncobjapi
WmiDestroyObject
Sections
.text Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.edata Size: 2KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX1 Size: 82KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 4KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 140KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ