Behavioral task
behavioral1
Sample
386708c49a0a8f7760047a92c3e7242f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
386708c49a0a8f7760047a92c3e7242f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
386708c49a0a8f7760047a92c3e7242f_JaffaCakes118
-
Size
208KB
-
MD5
386708c49a0a8f7760047a92c3e7242f
-
SHA1
97e3bce792c6d62c2d8b268cf78ba42145aafe41
-
SHA256
0777bce8c52f0da358984cf9612e5dca7be2d71a5cce1a91a18da1e326c5b744
-
SHA512
7685cfe9a4625f40f93d27626506f3a8134a8547238d175cb6063a170ca421c7c4fa5be68b83ee66f20170447d5ee0a86333579f41282d6fd908018b96cc3a03
-
SSDEEP
3072:zVqTYRJz9lona+YjNZaJ39GDB5QBg+KlCGfmEJyUo6jwydG1mXDWr1:z48dSnUY396+Bg+u27yA1RJ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 386708c49a0a8f7760047a92c3e7242f_JaffaCakes118
Files
-
386708c49a0a8f7760047a92c3e7242f_JaffaCakes118.exe windows:4 windows x86 arch:x86
dea66f29ae4cc5a8d304b792230942e4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
lstrcpyA
lstrcatA
WriteProcessMemory
WriteFile
VirtualAllocEx
Sleep
SizeofResource
SetThreadPriority
SetPriorityClass
SetFileAttributesA
ResumeThread
OutputDebugStringA
OpenProcess
MoveFileExA
MoveFileA
LockResource
LoadResource
LoadLibraryA
GetVersionExA
GetSystemDirectoryA
GetShortPathNameA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetCurrentThread
GetCurrentProcess
FreeLibrary
FindResourceA
DeleteFileA
CreateRemoteThread
CreateFileA
CopyFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetCurrentThreadId
GetStartupInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
shell32
ShellExecuteExA
ShellExecuteA
user32
GetKeyboardType
MessageBoxA
Sections
UPX0 Size: 204KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE