Behavioral task
behavioral1
Sample
86f64424d99909d4f13efa487eb0be8f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
86f64424d99909d4f13efa487eb0be8f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
86f64424d99909d4f13efa487eb0be8f_JaffaCakes118
-
Size
64KB
-
MD5
86f64424d99909d4f13efa487eb0be8f
-
SHA1
58c9c9dea9d96e1cae687ab6e2c347fa76cd472b
-
SHA256
e918a255cef3f05076f2256c7a95efd2392be563d9c6b5224078b51febe87d36
-
SHA512
99771be6f96bbd60c2621a242a53878d469ac88ca53222cf01813b6cab7767aa9e9a8cbc6a5ade8b5251042d18a047402c5cebc8c5869f7a06e50fa1057e61f9
-
SSDEEP
768:wAoiqqZOtQphJKODkRmh+5IO+BWaSEWxo:hvqqZgQZ/Dc59mWa
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 86f64424d99909d4f13efa487eb0be8f_JaffaCakes118
Files
-
86f64424d99909d4f13efa487eb0be8f_JaffaCakes118.exe windows:4 windows x86 arch:x86
d34b55fc9cdaac4fee93d69dc1b14dd1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
WritePrivateProfileStringA
WinExec
Sleep
LoadLibraryA
GetVersionExA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetFileAttributesA
ExitProcess
CreateThread
CopyFileA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
mpr
WNetCancelConnectionA
WNetAddConnection2A
oleaut32
SysFreeString
SysReAllocStringLen
urlmon
URLDownloadToFileA
user32
GetKeyboardType
MessageBoxA
CharNextA
GetMessageA
DispatchMessageA
wininet
InternetGetConnectedState
wsock32
WSACleanup
WSAStartup
gethostbyname
socket
shutdown
sendto
send
recv
inet_ntoa
inet_addr
htons
connect
closesocket
Sections
UPX0 Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE