Behavioral task
behavioral1
Sample
5b967dbd45ff71920649c063f86ec552_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5b967dbd45ff71920649c063f86ec552_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5b967dbd45ff71920649c063f86ec552_JaffaCakes118
-
Size
287KB
-
MD5
5b967dbd45ff71920649c063f86ec552
-
SHA1
1e2dd694c58cd4df06236a3ffe02539996a5e18b
-
SHA256
b2aca8b490c77fe8f1dd9ffaa351cb57bf8170e216c0352bef7a8a1ad3411219
-
SHA512
4decb421b8a5cdb2abd495c4077648533823da727b65bd7ea1a3477dcc10b1cc216d47eaffe21dbf0a8f849d6a85dfd4f086d204d99ba26a7c00732f32a8ce0f
-
SSDEEP
3072:MCxnuAgUo+Degm45uJZo31XVgwEKTbodcf/PYkXBxbCnvG2oxHe4JyG9ofOafBop:3hA+DuJ7GsMYWLCvGeSo2am
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b967dbd45ff71920649c063f86ec552_JaffaCakes118
Files
-
5b967dbd45ff71920649c063f86ec552_JaffaCakes118.exe windows:4 windows x86 arch:x86
2e8d42658e12586b6d34d35aef174274
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SizeofResource
FindResourceA
LoadResource
CreateProcessA
ExpandEnvironmentStringsA
LockResource
lstrcpyA
CloseHandle
lstrlenA
GetLastError
WriteFile
GetFileType
CreateFileA
CreateDirectoryA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
SetFilePointer
SetHandleCount
GetStdHandle
SetEndOfFile
ReadFile
SetStdHandle
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
GetStringTypeA
GetStringTypeW
advapi32
RegSetValueExA
RegCloseKey
RegCreateKeyExA
Sections
UPX0 Size: 284KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE