Behavioral task
behavioral1
Sample
5ecbc66fb165a5a07e3365cbbddc991b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5ecbc66fb165a5a07e3365cbbddc991b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5ecbc66fb165a5a07e3365cbbddc991b_JaffaCakes118
-
Size
191KB
-
MD5
5ecbc66fb165a5a07e3365cbbddc991b
-
SHA1
4dffb472de962d4a1cb827d9cb5672c6b98574d0
-
SHA256
03e0217e03f68b5ab2a84bd9b1db96e6f14f068249ab99ef873992d6b315e37f
-
SHA512
834d30a391b6bddc7c2f1558b5a73196537b7556e703c4f62b4230f0cc528b5f99b3c8e1a3301d6396a485ddf2e9c5375128ffcaeb8df1251fa264630356f94e
-
SSDEEP
3072:/XvlSmK+ZUPYp1jh2nKsxDzdeLKk4/gnyP7MFXlPRzei2xw5GZsqGKncnR2Fp4ND:Iy1jQxDzEOgnU7M/PR6iUNW+C2oXMh0p
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ecbc66fb165a5a07e3365cbbddc991b_JaffaCakes118
Files
-
5ecbc66fb165a5a07e3365cbbddc991b_JaffaCakes118.exe windows:5 windows x86 arch:x86
9a10682bcd09b19c76ab834ee90440a9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyW
lstrlenA
GetDriveTypeW
GetLogicalDrives
GetVolumeNameForVolumeMountPointW
SetEvent
CreateThread
CreateEventW
WaitForSingleObjectEx
GetCurrentProcessId
DuplicateHandle
lstrcatW
VirtualFree
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
GetProcAddress
GetStartupInfoA
LocalAlloc
GetCurrentThread
LocalFree
GetModuleHandleW
LeaveCriticalSection
WriteFile
lstrlenW
EnterCriticalSection
GetVersionExW
CreateFileW
GetLocalTime
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
GetLastError
lstrcpynW
lstrcmpiW
GetCurrentProcess
msvcrt
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
??2@YAPAXI@Z
advapi32
CloseServiceHandle
RegEnumValueW
QueryServiceConfigW
ControlService
StartServiceW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
OpenSCManagerW
OpenServiceW
ChangeServiceConfigW
RegCreateKeyExW
RegCloseKey
user32
wvsprintfW
wsprintfW
GetWindowLongW
PostMessageW
GetParent
SetDlgItemTextW
EnableWindow
GetDlgItem
SetCursor
SetWindowLongW
SendMessageW
DestroyIcon
SendDlgItemMessageW
KillTimer
FindWindowExW
GetClassNameW
RegisterDeviceNotificationW
SetTimer
ShowWindow
LoadCursorW
MessageBoxW
comctl32
PropertySheetW
ord17
shell32
ShellExecuteW
SHGetFolderPathW
ord71
SHGetFileInfoW
shlwapi
PathAppendW
StrCmpNIW
setupapi
SetupDiGetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoList
SetupDiOpenDeviceInterfaceW
SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDevRegKey
SetupDiDeleteDeviceInterfaceData
SetupDiDestroyDeviceInfoList
ole32
CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoInitialize
CoUninitialize
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OGRE2.01 Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE