Behavioral task
behavioral1
Sample
4303e79fa9e050b28a81df586ea57fa7_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4303e79fa9e050b28a81df586ea57fa7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4303e79fa9e050b28a81df586ea57fa7_JaffaCakes118
-
Size
1.1MB
-
MD5
4303e79fa9e050b28a81df586ea57fa7
-
SHA1
d4370ab0a41f3549131944c0aac33ddee95297fa
-
SHA256
815dcd92f07ebe79f3de685c4b9ad377fa99a977d305da178d6e6e03f4c134a1
-
SHA512
49e8282aa1e35dbf2bfd79050f2b92318989dbbf2df8b7de9ff0d3b2541fe31365aa4048e5e408e18794939ab7f0ffa42476281c977e5c021aa0505d7b83b5a3
-
SSDEEP
1536:XmUGS3VlBuXPT22wl/8HjjMTCo25zzycFmf:2p/T1wl0HMmo0nycFmf
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4303e79fa9e050b28a81df586ea57fa7_JaffaCakes118
Files
-
4303e79fa9e050b28a81df586ea57fa7_JaffaCakes118.exe windows:4 windows x86 arch:x86
f1afa9ff0e2c599f466c389dd2c9d6dc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
lstrlenA
WideCharToMultiByte
GetCurrentThreadId
MultiByteToWideChar
Sleep
GetLastError
CreateMutexA
GetWindowsDirectoryA
TerminateThread
CreateThread
ExitThread
ReleaseMutex
InterlockedDecrement
InterlockedIncrement
OpenProcess
GetVersionExA
GetProcAddress
LoadLibraryA
HeapFree
GetExitCodeProcess
GetStringTypeW
GetModuleFileNameA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
HeapSize
GetFileType
GetStdHandle
SetHandleCount
SetFilePointer
ReadFile
WriteFile
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
GetDriveTypeA
GetFullPathNameA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetEnvironmentStringsW
GetEnvironmentStrings
GetStringTypeA
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
CreateFileA
FlushFileBuffers
GetOEMCP
SetStdHandle
CreateProcessA
WaitForSingleObject
CloseHandle
GetCurrentDirectoryA
HeapReAlloc
GetTimeZoneInformation
HeapAlloc
MoveFileA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
SetEndOfFile
GetLocalTime
GetSystemTime
DeleteFileA
ExitProcess
TerminateProcess
GetCurrentProcess
GetFileAttributesA
RtlUnwind
advapi32
RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
iphlpapi
GetIpForwardTable
ole32
CoInitialize
CoUninitialize
CoGetClassObject
oleaut32
user32
CloseDesktop
PostMessageA
DispatchMessageA
IsWindow
MoveWindow
SetWindowLongA
GetWindowLongA
PostQuitMessage
FindWindowA
FindWindowExA
WaitForInputIdle
EnumDesktopWindows
GetWindowTextA
GetParent
GetClassNameA
CreateDesktopA
GetThreadDesktop
SetThreadDesktop
CreateWindowExA
SetTimer
GetMessageA
KillTimer
GetWindowThreadProcessId
TranslateMessage
DestroyWindow
wininet
InternetOpenA
InternetSetOptionA
InternetOpenUrlA
InternetCloseHandle
HttpQueryInfoA
InternetReadFile
ws2_32
WSASocketA
Sections
UPX0 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE