Behavioral task
behavioral1
Sample
3a8275590fe42ba169648da51ffb2f27_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3a8275590fe42ba169648da51ffb2f27_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3a8275590fe42ba169648da51ffb2f27_JaffaCakes118
-
Size
77KB
-
MD5
3a8275590fe42ba169648da51ffb2f27
-
SHA1
08df0585d74c97562fc1b02bb02c6a2792355643
-
SHA256
fb06d4d0054bc91a844692522399c605a52ddfc95cfe6e079a2c37a7716cfa80
-
SHA512
aad6599ecfae171ba58ef3656f7fc257ca26a5bd569aa117dfaea09240fd1cf8ca51c476e89c4921585943b9a4fb37a28d7bd1e3974de8193c451f4378ea68c6
-
SSDEEP
768:+OuqkCYBVszH7TgIzRyW6PKitbuoAMkMc35E5aOTHPeZnhH2:VuqJYBVsbgIF8iitbuopFc3WaOTHPe6
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a8275590fe42ba169648da51ffb2f27_JaffaCakes118
Files
-
3a8275590fe42ba169648da51ffb2f27_JaffaCakes118.exe windows:4 windows x86 arch:x86
e99f0be17e13e0b4cde9bbfd7b6952e0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
_lwrite
_lcreat
_lclose
WinExec
TerminateProcess
Sleep
SizeofResource
SetPriorityClass
OpenProcess
LockResource
LoadResource
GetWindowsDirectoryA
GetVersionExA
GetTickCount
GetTempPathA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetCurrentProcessId
GetCurrentProcess
FindResourceA
ExitProcess
EndUpdateResourceA
DeleteFileA
CreateThread
CreateProcessA
CopyFileA
CloseHandle
BeginUpdateResourceA
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetCurrentThreadId
SetCurrentDirectoryA
GetStartupInfoA
GetModuleFileNameA
GetCurrentDirectoryA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
gdi32
SelectObject
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
iphlpapi
GetIpAddrTable
shell32
ShellExecuteA
user32
UpdateWindow
TranslateMessage
ShowWindow
ShowCursor
SetWindowPos
SetWindowLongA
SetForegroundWindow
SetCursor
SendMessageA
RegisterClassExA
PostMessageA
OpenClipboard
MoveWindow
MessageBoxA
LoadIconA
LoadCursorA
IsWindowVisible
IsWindow
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowLongA
GetSystemMetrics
GetWindow
GetMessageA
GetForegroundWindow
GetDlgItem
GetDC
GetClassNameA
FindWindowExA
FindWindowA
EmptyClipboard
DispatchMessageA
DestroyWindow
DefWindowProcA
CreateWindowExA
CloseClipboard
CharLowerA
wsprintfA
GetKeyboardType
MessageBoxA
CharNextA
Sections
UPX0 Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE