Behavioral task
behavioral1
Sample
496d7c1df6f928cd2bdcbeaa18a8f57b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
496d7c1df6f928cd2bdcbeaa18a8f57b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
496d7c1df6f928cd2bdcbeaa18a8f57b_JaffaCakes118
-
Size
185KB
-
MD5
496d7c1df6f928cd2bdcbeaa18a8f57b
-
SHA1
dcf075ed1d7228e6d31dc312d92b952b766160ed
-
SHA256
2bf4c288212a8849b8ea68e94c029f1152bc55726ea9003e8a1517d0e189900c
-
SHA512
b7380347ed85fc8dfeb1e02a1c1184b6f12efb99d8482bb7326dfc571d4286ca7131ce0fed4785785db95a627a1c84c87084fdee1ae003548e8afb1065d118aa
-
SSDEEP
3072:6/nbeASScm+dcbzyRAosBTg9UojX1WYSL8keEWHZGZawgQ/NHUTX73KXxmQuW:UTW9dcbzyqoN9jX0dL8916awgQRUT76R
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 496d7c1df6f928cd2bdcbeaa18a8f57b_JaffaCakes118
Files
-
496d7c1df6f928cd2bdcbeaa18a8f57b_JaffaCakes118.exe windows:4 windows x86 arch:x86
1e82152a9f383f8d492ea08036a42cab
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetOverlappedResult
WaitForMultipleObjectsEx
ConnectNamedPipe
ReleaseMutex
FindClose
FindNextFileA
FindFirstFileA
CreateDirectoryA
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
OpenProcess
GetTickCount
QueryDosDeviceA
GetDriveTypeA
SetWaitableTimer
CreateWaitableTimerA
DeleteCriticalSection
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
InterlockedExchange
SetEnvironmentVariableA
DisconnectNamedPipe
ResumeThread
SuspendThread
SetEvent
InitializeCriticalSection
LoadLibraryA
CreateEventA
CreateMutexA
CreateNamedPipeA
CreateThread
FreeLibrary
WaitForSingleObjectEx
WriteFile
GetVersionExA
GetLastError
GetSystemDirectoryA
SetFilePointer
ReadFile
CreateFileA
CloseHandle
DeviceIoControl
GetModuleFileNameA
HeapFree
HeapAlloc
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
ExitProcess
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
TerminateProcess
GetCurrentProcess
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
Sleep
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
CompareStringA
CompareStringW
RaiseException
user32
wsprintfA
advapi32
QueryServiceConfigA
GetLengthSid
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
StartServiceCtrlDispatcherA
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 796B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE