Behavioral task
behavioral1
Sample
7048857cfd821abcbef37b548e6b7c5a_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7048857cfd821abcbef37b548e6b7c5a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
7048857cfd821abcbef37b548e6b7c5a_JaffaCakes118
-
Size
153KB
-
MD5
7048857cfd821abcbef37b548e6b7c5a
-
SHA1
aece7654a665b70f687cc43baaa7e786a78bcce3
-
SHA256
f03b5aeb24f0c4a202b8747e3d2d16cff9ceba3e1c0a0102660d1c96a5df6165
-
SHA512
5282e1ce40aba4ad0ddb39639e350584ff91022f2130bedeba5e0aa04b4f852fb2db02874711c30eee00b7577be18cd45cbbfc20e23d0732112f3672c1ba44d3
-
SSDEEP
3072:WQRBxKhIZQozGkfjuwsWfWh7aT8UzS8PUrw56:ZRJQsfCKWh7aT8Qsrx
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7048857cfd821abcbef37b548e6b7c5a_JaffaCakes118
Files
-
7048857cfd821abcbef37b548e6b7c5a_JaffaCakes118.exe windows:4 windows x86 arch:x86
be1a440d95634a02ba5f3ed6e1726a01
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileA
lstrcatA
GetSystemTime
ExitProcess
lstrlenA
GetModuleFileNameA
GetModuleHandleA
HeapCreate
HeapAlloc
HeapFree
lstrcpyA
WriteFile
ReadFile
GetFileSize
CreateFileA
GetWindowsDirectoryA
GetEnvironmentVariableA
SetFileAttributesA
GetFileAttributesA
SetFileTime
GetFileTime
FindNextFileA
FindClose
CreateProcessA
CloseHandle
user32
GetWindowTextA
GetMessageA
SetTimer
CreateWindowExA
RegisterClassExA
DefWindowProcA
IsWindow
FindWindowA
SendMessageA
KillTimer
GetClassNameA
EnumChildWindows
advapi32
RegSetValueExA
RegCreateKeyA
RegCloseKey
Sections
UPX0 Size: 9KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 46KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE