Behavioral task
behavioral1
Sample
3471a001374c23c6bad473c6ef1b294b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3471a001374c23c6bad473c6ef1b294b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3471a001374c23c6bad473c6ef1b294b_JaffaCakes118
-
Size
72KB
-
MD5
3471a001374c23c6bad473c6ef1b294b
-
SHA1
8b334d2b0501a2fa41c1bf2a18a375d9eb0c460f
-
SHA256
867d111eafd502730bf71ce97ee94c184d72e318d9bf0d09db40d9f12a1353af
-
SHA512
2f5206910e42fec3dc1f1c6d9b83149384906b2e3513c4e4dddceaa71f98dad63884e947cebcb7d45e870e5753529c99a54eaf9cac2014d6a982505c0df9ecf5
-
SSDEEP
768:5G4Z/ija+1Ix1O8cWZ5kT273T1VcXtxiosTREf7b4CCXSjweJne:5Gu1O8cWZ5pncXt0Flsbvpwe
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3471a001374c23c6bad473c6ef1b294b_JaffaCakes118
Files
-
3471a001374c23c6bad473c6ef1b294b_JaffaCakes118.exe windows:4 windows x86 arch:x86
a0e9d35ec5ac3efeffb84bb519546f9d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
Sleep
GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
GetStartupInfoA
GetModuleFileNameA
GetLastError
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
WritePrivateProfileStringA
WinExec
SetFileTime
SetFileAttributesA
OpenMutexA
LoadLibraryA
GetWindowsDirectoryA
GetTickCount
GetTempPathA
GetSystemDirectoryA
GetProcAddress
GetPrivateProfileStringA
GetFileTime
GetFileAttributesA
GetComputerNameA
InterlockedIncrement
FreeLibrary
DeleteFileA
CreateMutexA
CreateFileA
CreateDirectoryA
CopyFileA
CloseHandle
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
GetUserNameA
oleaut32
SysFreeString
SysReAllocStringLen
urlmon
URLDownloadToFileA
user32
GetKeyboardType
DestroyWindow
MessageBoxA
CharNextA
MessageBoxA
MessageBeep
wininet
DeleteUrlCacheEntry
ws2_32
gethostbyname
gethostname
inet_ntoa
WSACleanup
WSAStartup
Sections
UPX0 Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE