Behavioral task
behavioral1
Sample
727499d2293bfb4f0994878326ae4c7a_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
727499d2293bfb4f0994878326ae4c7a_JaffaCakes118
-
Size
393KB
-
MD5
727499d2293bfb4f0994878326ae4c7a
-
SHA1
fba5741c7bcb56df0bf1bb079f650409023316ce
-
SHA256
483d74c6e3cb9754f97387cf98acb2004103c9a431f3c93a57cdefbbc627b499
-
SHA512
f487cac1dbb0a0e7d250c7f4441a19895b959b1366223c6a1a08695889fb98b14df0b9bd7294bd51d6f5e32e645f1cab0bb036a3e9e4e940a34a4ccb42ac039d
-
SSDEEP
6144:NLRQAPVDkmf5/+MMYLjSXRrR/wNtU4Hvd4qVuDdUWNVYvjHrVO0JfXV4clGXj9b:NVPVD9/+M9QRrRyH14hDduvzAIdqpb
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 727499d2293bfb4f0994878326ae4c7a_JaffaCakes118
Files
-
727499d2293bfb4f0994878326ae4c7a_JaffaCakes118.exe windows:4 windows x86 arch:x86
9c8decf3582072f6edfc385a689f44f4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateDirectoryA
CreateFileA
DeleteFileA
ExitProcess
FreeLibrary
GetCommandLineA
GetFileTime
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetWindowsDirectoryA
LoadLibraryA
lstrcatA
lstrcmpiA
RemoveDirectoryA
SetFileTime
VirtualAlloc
VirtualFree
WriteFile
Sections
UPX0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pebundle Size: 168KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pebundle Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.JJav Size: 140KB - Virtual size: 144KB