Behavioral task
behavioral1
Sample
77fea13b678451e687f4c4915fe2d90b_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
77fea13b678451e687f4c4915fe2d90b_JaffaCakes118
-
Size
124KB
-
MD5
77fea13b678451e687f4c4915fe2d90b
-
SHA1
49da5b6db09eaa0064cd743ff74fbec5bd08ea8c
-
SHA256
44090b1d56cc13cdcd8f6aa6a688c0651cee0ef705cd4bb4defebc2b88f5662b
-
SHA512
fd9eb00bedb666ba69b14cbbe40b5103bb077eccfa426765117f5f3c5668afc42b1a8addb6cfcaf2a979032ccb20d00060b405be90aaaed589f6a114f3590261
-
SSDEEP
3072:/mhn47J+xDrtMhmxkB3nhnQfP4L4U+AAHlcaqrPATLLra:/mhU+BvxkJnh4P4MsrIH
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 77fea13b678451e687f4c4915fe2d90b_JaffaCakes118
Files
-
77fea13b678451e687f4c4915fe2d90b_JaffaCakes118.exe windows:5 windows x86 arch:x86
c517117213bffd3ed57ce0b59f295c3c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
_controlfp
__p__fmode
_XcptFilter
_exit
_c_exit
wcscat
wcscpy
_cexit
__set_app_type
_except_handler3
exit
wcslen
advapi32
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegisterEventSourceW
ReportEventW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
kernel32
WaitCommEvent
WaitForMultipleObjects
CreateEventW
CloseHandle
CreateFileW
SetCommMask
EscapeCommFunction
CreateThread
GetCurrentProcess
ResetEvent
LocalFree
FormatMessageW
GetComputerNameW
ExitProcess
Sleep
LocalAlloc
GetModuleHandleA
GetCommModemStatus
GetStartupInfoW
CreateProcessW
SetEvent
GetLastError
GetProcAddress
LoadLibraryW
FreeLibrary
WaitForSingleObject
netapi32
NetMessageBufferSend
user32
ExitWindowsEx
powrprof
SetSuspendState
IsPwrHibernateAllowed
GetPwrCapabilities
ole32
CoCreateInstance
CoInitialize
CoUninitialize
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE