Behavioral task
behavioral1
Sample
81e1a7e34b8d03a305569c52bbef0e72_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
81e1a7e34b8d03a305569c52bbef0e72_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
81e1a7e34b8d03a305569c52bbef0e72_JaffaCakes118
-
Size
32KB
-
MD5
81e1a7e34b8d03a305569c52bbef0e72
-
SHA1
f8179cdbcb122b3ee24a61e39f1c7c9ce73a5fab
-
SHA256
8ffe0994d404beab2fd4f78c1dfeac890096db3aeb6299845cec385e251371db
-
SHA512
f674c212ddc8fce35174096756160c1de9f5d862cab52117bec03ea188b615abeea7c68e9185dd8aa9c9f4a316f0136648809561dfbd7dfb86a2d1d5e5e8bc5c
-
SSDEEP
192:94YQWTAMPGsfFxsPEjeKGhIm/YB5RrcI6C/S7VvC+VVqTig1ZDFzBPW:a4AGX/smeKNBnA57VTVeT0
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 81e1a7e34b8d03a305569c52bbef0e72_JaffaCakes118
Files
-
81e1a7e34b8d03a305569c52bbef0e72_JaffaCakes118.exe windows:4 windows x86 arch:x86
9051f7ac2e354f8b8765f5c2bf088151
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
CreateThread
GetModuleHandleA
FlushFileBuffers
ExitProcess
GetVersionExA
GetWindowsDirectoryA
OpenMutexA
CreateToolhelp32Snapshot
GetSystemDirectoryA
GetTempFileNameA
GetTempPathA
Sleep
TerminateProcess
OpenProcess
WritePrivateProfileStringA
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrlenA
Process32First
CopyFileA
CloseHandle
CreateMutexA
GetCommandLineA
CreateFileA
Process32Next
RtlZeroMemory
WriteFile
advapi32
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
shell32
ShellExecuteA
user32
wsprintfA
CharUpperA
ExitWindowsEx
wininet
InternetOpenA
InternetConnectA
HttpSendRequestA
HttpOpenRequestA
InternetCloseHandle
wsock32
gethostname
listen
htons
send
bind
accept
inet_ntoa
socket
recv
gethostbyname
connect
closesocket
WSAStartup
Sections
UPX0 Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE