Behavioral task
behavioral1
Sample
5b6155098735c6f871965adaf75a837e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5b6155098735c6f871965adaf75a837e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5b6155098735c6f871965adaf75a837e_JaffaCakes118
-
Size
42KB
-
MD5
5b6155098735c6f871965adaf75a837e
-
SHA1
ce8851e97aec78128b3ceaed3e3f0b5f35903e10
-
SHA256
5076489bd2ccc7db6d11d1153c0d4057163821a2734d70d826674fdadc15213c
-
SHA512
8bbd8d1d2850ded6bcf9d6b5b8ede3e73ae8e6f82ec88e1c267d6adff9cfd4003de17ff61bf1dc982325740da59b4cd7c45227be64d1ece13dcc1146ed2e0bb9
-
SSDEEP
768:I0fQEbxXhl3yasg1Mn6wsmTwpgUatG9rOfwOIBr7CJssC4sAatedDlHZIB6XYCKZ:Ii79Xhl3yah1MnrzwpgZtG9rOfwxB/Cq
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b6155098735c6f871965adaf75a837e_JaffaCakes118
Files
-
5b6155098735c6f871965adaf75a837e_JaffaCakes118.exe windows:4 windows x86 arch:x86
ac8be2b9f84f4b2332199fd9fc7715b9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemInfo
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetACP
GetLocaleInfoA
GetVersionExA
InitializeCriticalSection
ExitProcess
GetCurrentThreadId
HeapCreate
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetModuleFileNameA
TlsAlloc
GetLastError
GetModuleHandleA
GetCurrentProcess
GetStartupInfoA
GetEnvironmentStringsW
LoadLibraryA
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetOEMCP
GetCPInfo
GetVersion
GetProcAddress
userenv
RefreshPolicy
GetProfilesDirectoryA
RsopFileAccessCheck
ForceSyncFgPolicy
ExpandEnvironmentStringsForUserW
DeleteProfileW
RegisterGPNotification
GetUserProfileDirectoryW
shgina
DllCanUnloadNow
Sections
UPX0 Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ThNyn Size: 3KB - Virtual size: 482KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rqHPbV Size: 4KB - Virtual size: 796KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.O Size: 2KB - Virtual size: 400KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 8KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.XR Size: 1KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 308KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 10KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ