Behavioral task
behavioral1
Sample
703b693e6bdc14970f9c54b0b20dc996_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
703b693e6bdc14970f9c54b0b20dc996_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
703b693e6bdc14970f9c54b0b20dc996_JaffaCakes118
-
Size
246KB
-
MD5
703b693e6bdc14970f9c54b0b20dc996
-
SHA1
a2bd833788ac9c87d83177795c54f3805099d71b
-
SHA256
88bc4df1d5d3073444bcc3f8ff274e3a716a9eaf50da6886e34645e2d3ac5287
-
SHA512
ab5c2a098856e8652127f6cf3967c2b00dfd904768f230f905c4cedc241ed13185fc26ca609af2abd43531c3a6368866797d68b56e88ccd3750465aa8ecd2ea4
-
SSDEEP
6144:EeEUq3/sSzA7pfXG7m9ln3T4Y9qd4yqUTJ7nTti:IM7p0mnn3kYYdeUTtpi
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 703b693e6bdc14970f9c54b0b20dc996_JaffaCakes118
Files
-
703b693e6bdc14970f9c54b0b20dc996_JaffaCakes118.exe windows:4 windows x86 arch:x86
b58b33fee3515f8f9be18210cf425a28
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
GlobalAlloc
CreateEventW
OpenEventW
GetCurrentProcessId
CreateSemaphoreW
GetSystemTime
GetModuleFileNameW
GetProcessHeap
HeapCreate
lstrlenA
ExitProcess
GetShortPathNameA
GetModuleFileNameA
MultiByteToWideChar
CreateMutexW
FreeLibrary
LoadLibraryW
GetSystemInfo
GetVersionExA
ExpandEnvironmentStringsW
CreateDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemDirectoryW
LoadLibraryA
GetVolumeInformationW
LocalFree
WaitForMultipleObjects
OpenEventA
GetLastError
GetFileAttributesW
Sleep
InitializeCriticalSection
GetCurrentThread
GetTickCount
SetEvent
WaitForSingleObject
GetCurrentProcess
lstrcpynA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetStartupInfoA
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
GetEnvironmentStringsW
BeginUpdateResourceW
GetProcAddress
user32
CharPrevA
CharUpperA
advapi32
AccessCheck
RegSetValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsA
GetTraceLoggerHandle
GetTraceEnableFlags
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
ReportEventW
DeregisterEventSource
RegisterEventSourceW
DuplicateToken
RevertToSelf
ImpersonateLoggedOnUser
AdjustTokenPrivileges
GetNamedSecurityInfoW
LookupPrivilegeValueA
MapGenericMask
TraceMessage
OpenThreadToken
OpenProcessToken
rpcrt4
RpcServerRegisterIf
RpcServerListen
RpcMgmtStopServerListening
RpcImpersonateClient
RpcServerUnregisterIf
RpcRevertToSelf
RpcServerUseProtseqEpA
NdrServerCall2
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
inseng
DownloadFile
DllGetClassObject
mf3216
Mf3216DllInitialize
Sections
.text Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 102KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 115KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ