Behavioral task
behavioral1
Sample
716b3bedff4d72dc0c4636dc0ff1c992_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
716b3bedff4d72dc0c4636dc0ff1c992_JaffaCakes118
-
Size
1.9MB
-
MD5
716b3bedff4d72dc0c4636dc0ff1c992
-
SHA1
d59d919746c00269edff76d7e874d7482b8e8b52
-
SHA256
d8cae6c83ea0e3584ad49aaa6ccdc904944cd17d082226613082c71d297aa678
-
SHA512
63387615448bd7bbfc9b164e2560212e88a6d0363f68036edbf7951c424351ac62fe013b9d8556737a77ff618a35967af24f0d684b2d63a9defdf155676bb6c6
-
SSDEEP
49152:F4LvpdCziCgljHxr8tUFaYDUWROCRolSDHhbD/k/ufZ:F4NyijljHxruUFaFWROCW0B//zh
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 716b3bedff4d72dc0c4636dc0ff1c992_JaffaCakes118
Files
-
716b3bedff4d72dc0c4636dc0ff1c992_JaffaCakes118.exe windows:4 windows x86 arch:x86
e43cf54da4347ebde36114c4cba1e88c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 888KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 860KB - Virtual size: 857KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ