Behavioral task
behavioral1
Sample
4151be8df6f21d15e13e0a484c43a450_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4151be8df6f21d15e13e0a484c43a450_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4151be8df6f21d15e13e0a484c43a450_JaffaCakes118
-
Size
504KB
-
MD5
4151be8df6f21d15e13e0a484c43a450
-
SHA1
2374e5d925c0384aacbd3053ec7a37b5583840fe
-
SHA256
87f0f13c488f7c85e625d959508ccffb3f7373e6c47ee64d924da009233a1f55
-
SHA512
824d7beaab0d2cf21ab519357933a0d643261137bf233d8901819647c51e482f4d317c028755b366aa40005200a5de2a98bb19594728fc374beacb1a763acf68
-
SSDEEP
6144:Fam9q/CAlcz2Sh445jaTn5ohLqUb30RWZ3Apb9:0mc6A6zc41aD5oEE3LZ36h
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4151be8df6f21d15e13e0a484c43a450_JaffaCakes118
Files
-
4151be8df6f21d15e13e0a484c43a450_JaffaCakes118.exe windows:4 windows x86 arch:x86
11f07ffbde51bae03cf2df1a15328008
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
GetVolumeInformationA
FindClose
FindFirstFileA
FindNextFileA
SetFileTime
SystemTimeToFileTime
GetSystemTime
CopyFileA
Sleep
DeleteFileA
GetModuleFileNameA
GetModuleHandleA
GetSystemDirectoryA
lstrcatA
ExitProcess
WaitForSingleObject
FreeLibrary
GetProcAddress
CreateFileA
GetPrivateProfileStringA
GetTempFileNameA
GetWindowsDirectoryA
GetLastError
CreateMutexA
InitializeCriticalSection
DeleteCriticalSection
RaiseException
SetEndOfFile
GetLocaleInfoW
SetStdHandle
ReadFile
GetOEMCP
lstrlenA
CloseHandle
GetFileSize
WriteFile
GetLocaleInfoA
GetACP
InterlockedExchange
LoadLibraryA
GetVersionExA
GetSystemInfo
VirtualProtect
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsBadCodePtr
IsBadReadPtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RtlUnwind
GetSystemTimeAsFileTime
HeapFree
GetStartupInfoA
GetCommandLineA
HeapReAlloc
HeapAlloc
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetCPInfo
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
SetFilePointer
FlushFileBuffers
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
HeapSize
VirtualQuery
GetStdHandle
UnhandledExceptionFilter
advapi32
RegOpenKeyA
RegSetValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
StartServiceA
RegCreateKeyExA
ole32
CoUninitialize
CoInitialize
CoCreateInstance
shell32
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
user32
LoadIconA
RegisterClassExA
DispatchMessageA
TranslateMessage
PeekMessageA
UpdateWindow
CreateWindowExA
LoadCursorA
ShowWindow
wininet
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetCloseHandle
InternetCrackUrlA
InternetReadFile
Sections
UPX0 Size: 500KB - Virtual size: 500KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE