Behavioral task
behavioral1
Sample
3ebdfc8435133900e4d2ac05936b43f8_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3ebdfc8435133900e4d2ac05936b43f8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3ebdfc8435133900e4d2ac05936b43f8_JaffaCakes118
-
Size
102KB
-
MD5
3ebdfc8435133900e4d2ac05936b43f8
-
SHA1
3aa668b7e7ceeec8bb7c8ced8d9e33a52060c153
-
SHA256
e68737b9512b55e1cbc454203df8fb559fcc107a2a24d470f422ca1e86082099
-
SHA512
c316b0a40ac9324010e79963df4c3f22dbb28bbfd0ebe1edfb19f8e6ac080ed039eff730a5a2a1f05b62361dccb2cb6ef6be6624b1472338c875473bc3c30390
-
SSDEEP
1536:h/gqlEwebMoBU2EY0B0BOVE6pMTAqgr1bVkzBMVJuHLW0g9TEl:/jfTBV5EAxh5oAAHLW0g9M
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ebdfc8435133900e4d2ac05936b43f8_JaffaCakes118
Files
-
3ebdfc8435133900e4d2ac05936b43f8_JaffaCakes118.exe windows:1 windows x86 arch:x86
6fe73a9b8978d2ff8a11224b3b228b65
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
lstrcpyA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
GetModuleFileNameA
WriteFile
WinExec
WaitForSingleObject
VirtualQuery
UpdateResourceA
TerminateProcess
Sleep
SizeofResource
SetThreadPriority
SetFilePointer
SetFileAttributesA
SetEndOfFile
ResumeThread
ReleaseSemaphore
ReadFile
OpenSemaphoreA
OpenProcess
MoveFileA
LockResource
LoadResource
LoadLibraryExA
LeaveCriticalSection
InitializeCriticalSection
GetWindowsDirectoryA
GetVersionExA
GetThreadLocale
GetSystemTime
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetDiskFreeSpaceA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentDirectoryA
GetComputerNameA
GetCPInfo
FreeLibrary
FormatMessageA
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
EndUpdateResourceA
DeleteFileA
DeleteCriticalSection
CreateSemaphoreA
CreateFileA
CreateEventA
CopyFileA
CompareStringA
CloseHandle
BeginUpdateResourceA
user32
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
UnregisterClassA
SendMessageA
RegisterClassA
PostMessageA
PeekMessageA
MsgWaitForMultipleObjects
MessageBoxA
LoadStringA
GetSystemMetrics
GetClassInfoA
ExitWindowsEx
DestroyWindow
DefWindowProcA
CreateWindowExA
CharUpperA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegFlushKey
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
oleaut32
VariantChangeTypeEx
VariantCopyInd
VariantClear
SysStringLen
SysFreeString
SysReAllocStringLen
SysAllocStringLen
mpr
WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum
svrapi
NetShareDel
NetShareAdd
Sections
UPX0 Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE