Behavioral task
behavioral1
Sample
61246e4a4bf4df4bd923c60493f48208_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
61246e4a4bf4df4bd923c60493f48208_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
61246e4a4bf4df4bd923c60493f48208_JaffaCakes118
-
Size
37KB
-
MD5
61246e4a4bf4df4bd923c60493f48208
-
SHA1
45dcf16c87d190de32750c49ed22575add08b7ba
-
SHA256
7c7d87a096c62238463f44bfc769fef56af4d4c619a85864a1ea3991323ea66b
-
SHA512
88b105ca7581e1a12b6616845e1a6af40fea744ac718644e554ed0914ac8b7419f3017922c9e4d29c8cd58ef639ef0b1c1bc79026ba123e7e8714e8cc8e06434
-
SSDEEP
768:KkAFCi9R3L6K4mokKCEZTEfIrdMTx3KZ6kGVMSb7:K1nb32R9CEZTEfIrKTx3KZ3Gb7
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 61246e4a4bf4df4bd923c60493f48208_JaffaCakes118
Files
-
61246e4a4bf4df4bd923c60493f48208_JaffaCakes118.exe windows:4 windows x86 arch:x86
8306c57f0fdd11e6ef7775dde6fc58e7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mapi32
ord137
ord174
ord60
ord15
ord135
ord139
ord21
ord11
ord23
ord19
ord13
ord147
ord75
ord129
ord17
ord140
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
kernel32
GetStringTypeA
LoadLibraryA
GetOEMCP
GetCPInfo
SetUnhandledExceptionFilter
GetStringTypeW
GetLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetSystemTime
MultiByteToWideChar
Sleep
FileTimeToDosDateTime
GetModuleFileNameA
IsBadWritePtr
IsBadCodePtr
IsBadReadPtr
GetACP
lstrlenA
lstrlenW
OpenFile
IsValidCodePage
GetLastError
lstrcmpA
lstrcpyA
lstrcpyW
GetCurrentProcessId
GlobalAlloc
GetFileAttributesA
GetVersion
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapCreate
ExitProcess
GetCurrentProcess
GetStartupInfoA
GetEnvironmentStringsW
GetProcAddress
user32
GetFocus
wsprintfA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CloseServiceHandle
QueryServiceStatus
OpenServiceA
RegConnectRegistryA
RegSetValueExA
OpenSCManagerA
msasn1
ASN1intx_free
ASN1_Decode
ASN1utf8string_free
ASN1open_free
ASN1BERDecExplicitTag
ASN1CEREncZeroMultibyteString
ASN1ztchar32string_free
ASN1BEREncOctetString
ASN1objectidentifier_free
ASN1BEREncEoid
gdi32
GetTextExtentPointA
CreateScalableFontResourceA
CreateFontW
CreateBrushIndirect
CreateBitmap
CreateSolidBrush
CreateCompatibleDC
Sections
UPX1 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TI Size: 4KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.yARJD Size: 2KB - Virtual size: 565KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 4KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Lh Size: 1KB - Virtual size: 329KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 8KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.F Size: 2KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ