Behavioral task
behavioral1
Sample
44e20352ea2e3dbdaf5df8675d168183_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
44e20352ea2e3dbdaf5df8675d168183_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
44e20352ea2e3dbdaf5df8675d168183_JaffaCakes118
-
Size
138KB
-
MD5
44e20352ea2e3dbdaf5df8675d168183
-
SHA1
2c8e03e1042548c090594c6a712388718ac2ece0
-
SHA256
52adde9ff629a5f0912c3fbd111911ef93bd451376c68fde15dbf6f394c3ab1c
-
SHA512
3344f9d7265c90a3b0dcca14ebedf43ad4bd73b5f4f0e40760808b13211c2469dede573ec918dc1a1c50e9a2f1203efab8028f2724bf24c8d748f3057da18efd
-
SSDEEP
3072:6iKIM3poVWnjfPnmuJvslY8B11vPxHpkSfpe:6iKIM3poVWLPnXJeY8FvF7fk
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44e20352ea2e3dbdaf5df8675d168183_JaffaCakes118
Files
-
44e20352ea2e3dbdaf5df8675d168183_JaffaCakes118.exe .vbs windows:5 windows x86 arch:x86 polyglot
e6aa7f9168c25d99598cf34c58b2a943
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
nddeapi
ord509
ord501
msvcrt
sprintf
_c_exit
_exit
_XcptFilter
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3
advapi32
IsValidSecurityDescriptor
GetTokenInformation
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
MakeSelfRelativeSD
OpenThreadToken
OpenProcessToken
RegSetValueExA
RegEnumValueA
RegDeleteValueW
GetSecurityDescriptorDacl
GetAce
SetFileSecurityW
RegSetValueExW
RevertToSelf
RegDeleteValueA
RegCloseKey
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegOpenKeyExA
RegCreateKeyExA
kernel32
CreateFileW
DeleteFileW
GetLastError
GetComputerNameA
lstrcmpW
MultiByteToWideChar
LocalAlloc
lstrlenW
CreateFileA
GetTickCount
GetWindowsDirectoryA
lstrlenA
lstrcpyA
lstrcmpA
lstrcpyW
WriteFile
GlobalFree
GlobalHandle
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalSize
DeleteFileA
lstrcatA
GlobalReAlloc
GetCurrentProcess
LocalFree
lstrcmpiA
GetModuleHandleA
CloseHandle
CreateMutexA
WaitForSingleObject
ReleaseMutex
SetFilePointer
ReadFile
WideCharToMultiByte
GetCurrentThread
gdi32
SetWindowExtEx
SetViewportExtEx
SetMapMode
SaveDC
GetEnhMetaFileHeader
PatBlt
SelectObject
CreateBitmap
CreateCompatibleDC
CreateBitmapIndirect
SetMetaFileBitsEx
CreatePalette
SetEnhMetaFileBits
GetDIBits
RealizePalette
SelectPalette
CreateDIBitmap
SetStretchBltMode
RestoreDC
SetViewportOrgEx
PlayMetaFile
PlayEnhMetaFile
CreateFontA
DeleteObject
DeleteDC
GetBitmapBits
GetEnhMetaFileBits
GetObjectA
GetPaletteEntries
GetMetaFileBitsEx
StretchBlt
GetStockObject
user32
SetProcessWindowStation
GetDC
ReleaseDC
FillRect
DrawTextA
DrawTextW
LoadCursorA
SetCursor
ShowCursor
EnumClipboardFormats
GetClipboardFormatNameW
LoadStringW
GetClipboardData
IsClipboardFormatAvailable
CountClipboardFormats
EmptyClipboard
wsprintfW
DdeGetData
DdeGetLastError
SendMessageA
RegisterClipboardFormatA
PostQuitMessage
DdeUninitialize
DdeNameService
SetClipboardData
DefWindowProcA
DdeAddData
DdeUnaccessData
DdeFreeDataHandle
DdeAccessData
DdeCreateDataHandle
RegisterClipboardFormatW
OpenClipboard
CloseClipboard
DdeInitializeA
CreateWindowExA
OpenWindowStationA
RegisterClassA
LoadIconA
UnregisterClassA
DispatchMessageA
TranslateMessage
GetMessageA
DdeKeepStringHandle
DdeCmpStringHandles
DdeFreeStringHandle
DdeQueryStringA
DdePostAdvise
DdeImpersonateClient
DdeCreateStringHandleA
DdeCreateStringHandleW
wsprintfA
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE