Behavioral task
behavioral1
Sample
70c4567482a5279e709715bdb348e419_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
70c4567482a5279e709715bdb348e419_JaffaCakes118
-
Size
165KB
-
MD5
70c4567482a5279e709715bdb348e419
-
SHA1
47e958da4653bfe14d47f3ff4a3beef8e0143699
-
SHA256
c86b52c63f417bd60980c2de4529c5e6b6ef120cc95952b11ac61c7ba31e7892
-
SHA512
01f5e12c752cd519dbca9064e340575c58c151c61c53173d8c0beaf5a7b6a02cc6c2197de80638b8b05e0d679a9195ab04a2c283a1292ac49ac77e56dc8a7e3a
-
SSDEEP
3072:MUvm0psSn9KJ5nkgGIbJBgetDAz03tXDX8k3+8pNRjFBGNz5jW5YaYwOr:A0psSy5kgJL9X8k3loW5Tq
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70c4567482a5279e709715bdb348e419_JaffaCakes118
Files
-
70c4567482a5279e709715bdb348e419_JaffaCakes118.exe windows:5 windows x86 arch:x86
47e6ee77a094f688380af650b457a32b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFullPathNameW
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
GetComputerNameExW
GetModuleFileNameW
GetConsoleOutputCP
ExitProcess
GetSystemDirectoryW
LoadLibraryW
FreeLibrary
HeapReAlloc
HeapFree
WriteConsoleW
ReadConsoleW
HeapSize
HeapAlloc
GetProcessHeap
HeapValidate
WideCharToMultiByte
MultiByteToWideChar
CompareStringA
GetThreadLocale
CompareStringW
lstrlenW
lstrlenA
GetFileAttributesW
GetStdHandle
GetConsoleMode
SetConsoleMode
FlushConsoleInputBuffer
ReadFile
GetCurrentDirectoryW
FindFirstFileW
FindNextFileW
FindClose
GetVolumePathNameW
GetVolumeInformationW
CreateFileW
LocalFree
GetComputerNameW
GetLastError
GetCurrentProcessId
OpenProcess
CloseHandle
GetFileType
VerSetConditionMask
VerifyVersionInfoW
FormatMessageW
SetLastError
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
wcsrchr
wcspbrk
_wcsicmp
wcstok
_iob
_vsnwprintf
_errno
_get_osfhandle
_fileno
toupper
wcstod
wcstoul
wcstol
fflush
fprintf
strtok
_except_handler3
advapi32
GetFileSecurityW
AllocateAndInitializeSid
LookupAccountNameW
CheckTokenMembership
FreeSid
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
AddAce
GetTokenInformation
InitializeSecurityDescriptor
GetSecurityInfo
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
SetFileSecurityW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
user32
LoadStringW
CharUpperW
mpr
WNetAddConnection2W
WNetGetLastErrorW
WNetCancelConnection2W
secur32
GetUserNameExW
ws2_32
WSACleanup
WSAStartup
WSAGetLastError
inet_addr
gethostbyaddr
shlwapi
StrStrIW
StrChrW
StrChrIW
StrStrW
netapi32
NetServerGetInfo
NetApiBufferFree
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
Sections
.text Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE