Behavioral task
behavioral1
Sample
2d175a11ba5e170de44ef1ae4181a70a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2d175a11ba5e170de44ef1ae4181a70a_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2d175a11ba5e170de44ef1ae4181a70a_JaffaCakes118
-
Size
160KB
-
MD5
2d175a11ba5e170de44ef1ae4181a70a
-
SHA1
91926ccf56d862609c7ee3e8dcc76458e88ede47
-
SHA256
1c8ec08ca689cf94e80c112a60d7a71e74a6e76b90c6c4d0365c68d60a428079
-
SHA512
70c81e2339be484111ab1f8a7aacc9fb7f57b8c2a8055e42c0a1df8315a5c17dc14346f753f6fcd84fce2968e7e46091b71e2f34ca7c2c34e5860cd85c7f4151
-
SSDEEP
3072:F2k2JqleOrTyo9ggb3z3qzXtTBfkJNTchfWWw:F2k2JMPxg+azXtTBc6fW
Malware Config
Signatures
-
resource yara_rule sample aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d175a11ba5e170de44ef1ae4181a70a_JaffaCakes118
Files
-
2d175a11ba5e170de44ef1ae4181a70a_JaffaCakes118.exe windows:4 windows x86 arch:x86
3587b4a018ddb5445bf971dc3258ea0b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
lstrlenA
SetPriorityClass
GetSystemDirectoryA
CloseHandle
WriteFile
CreateFileA
GlobalFree
LockResource
GlobalAlloc
LoadResource
SizeofResource
FindResourceA
GetCurrentThread
SetThreadPriority
ResumeThread
CreateProcessA
GetStartupInfoA
user32
MessageBoxA
advapi32
RegCloseKey
RegSetValueExA
RegOpenKeyA
RegDeleteValueA
mfc42
ord535
ord800
ord924
ord537
msvcrt
_exit
_XcptFilter
exit
_onexit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
__CxxFrameHandler
_acmdln
msvcp60
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
Sections
.text Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: 4KB - Virtual size: 942B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: 4KB - Virtual size: 942B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
RCryptor Size: 117B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 524B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.adata Size: 4KB - Virtual size: 942B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE