Behavioral task
behavioral1
Sample
41e0890df157874e9d48ebc50d5a2c2f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
41e0890df157874e9d48ebc50d5a2c2f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
41e0890df157874e9d48ebc50d5a2c2f_JaffaCakes118
-
Size
110KB
-
MD5
41e0890df157874e9d48ebc50d5a2c2f
-
SHA1
16308bc896868044433f8c15ec8f83d45c6962aa
-
SHA256
0c1287d6370e27638dac773e830c26e30311df02c9408f4a5ae151f60ff72e4c
-
SHA512
bcb8666625ab1b4ae3c10d017070e0ef45422d97df389bf273bef33c526175883f18bb694b954339e918963a0eed607c9325f9e9dc53c88cc599b62b7d2c1970
-
SSDEEP
96:nPvfQYRVK9SFrYdY3M1TefpihtG8gRDkqTGlMGoQbkRUdNppkfMOQuJ0HprcVZ:nHTaKsdmqy2G8wGlMKka40G0HprcH
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41e0890df157874e9d48ebc50d5a2c2f_JaffaCakes118
Files
-
41e0890df157874e9d48ebc50d5a2c2f_JaffaCakes118.exe windows:1 windows x86 arch:x86
f854d8e1e5567499d5e25e6f7e1a5b0e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
OpenProcess
SetThreadPriority
Process32Next
_lwrite
_lopen
CreateToolhelp32Snapshot
Process32First
_lread
_lcreat
_lclose
Sleep
TerminateProcess
WinExec
lstrlenA
GetCurrentProcessId
CreateThread
ExitProcess
ResumeThread
advapi32
RegOpenKeyA
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
msvcrt
memset
memcpy
memcmp
atol
user32
CharUpperBuffA
ws2_32
bind
closesocket
gethostbyname
htonl
htons
inet_addr
inet_ntoa
listen
ntohs
recv
send
setsockopt
WSAAccept
WSACleanup
WSAConnect
WSAIoctl
WSASocketA
WSAStartup
Sections
UPX0 Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE