Behavioral task
behavioral1
Sample
6158720bfc439609053c95d524e7041e_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
6158720bfc439609053c95d524e7041e_JaffaCakes118
-
Size
160KB
-
MD5
6158720bfc439609053c95d524e7041e
-
SHA1
7a795971cd8584ad483fcc4c140469aa1597d09b
-
SHA256
156170abc23f94a22e2f7ad9601c649c93496b6046f75ed830e998b64f1da808
-
SHA512
305cce68bcb107de927ac7bb262013f1ad1d860fa9e14d3ed50166a53c53b9ed33b809d3ab137094e22811091e1e07d36ba0cdd6978b5b7958601fc7d24203e8
-
SSDEEP
3072:ajzs49wvo/4n0sJI26Gb1rTSb6DmWy5DjkXv9B:so4WVO15+DtK+vD
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6158720bfc439609053c95d524e7041e_JaffaCakes118
Files
-
6158720bfc439609053c95d524e7041e_JaffaCakes118.exe windows:4 windows x86 arch:x86
a5e2bf0f936a355dd08f4b6192222b80
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalFree
GlobalAlloc
GetCurrentProcess
CompareStringW
CompareStringA
GetModuleFileNameA
GetProcAddress
HeapReAlloc
VirtualAlloc
GetStringTypeW
GetStringTypeA
CreateDirectoryA
GetTempFileNameA
GetShortPathNameA
GetSystemDirectoryA
CopyFileA
GetVersionExA
MoveFileExA
GetWindowsDirectoryA
LoadLibraryA
WritePrivateProfileStringA
WriteFile
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetLastError
GetFileAttributesA
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetCPInfo
GetACP
GetOEMCP
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetEnvironmentVariableA
user32
LoadStringA
CharToOemA
DialogBoxParamA
EndDialog
GetDlgItem
SetWindowTextA
SetWindowPos
MessageBoxA
advapi32
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
OpenProcessToken
shell32
ShellExecuteA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 104KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE