Behavioral task
behavioral1
Sample
898797afd1ad17397fa0d95c3cee9ab4_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
898797afd1ad17397fa0d95c3cee9ab4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
898797afd1ad17397fa0d95c3cee9ab4_JaffaCakes118
-
Size
282KB
-
MD5
898797afd1ad17397fa0d95c3cee9ab4
-
SHA1
0b98cdca56fef911b51369f508f36b611938fc7f
-
SHA256
fd6caa991608de9f3cac20b6b6f2b76005197f74aaf8313938568c7c58335bde
-
SHA512
d8bd7e61681e54661a0a8a520a17100232d5c07b3b7bb33790ceb6a40b237989175ced375de6a2e91c076c4fa4d1b5a223ecdf81cf4b3f639ceaa0cc06427ee6
-
SSDEEP
6144:dZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF1M:nFTxWYMh5qoLb8LCy9E
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 898797afd1ad17397fa0d95c3cee9ab4_JaffaCakes118
Files
-
898797afd1ad17397fa0d95c3cee9ab4_JaffaCakes118.exe windows:4 windows x86 arch:x86
913a4a367a3cc426f8f8ac8fe6743a43
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AllocateAndInitializeSid
EqualSid
FreeSid
GetTokenInformation
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
kernel32
FileTimeToSystemTime
FreeLibrary
GetCurrentProcess
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcessHeap
GetSystemDirectoryA
GetVersion
GetVersionExA
GetWindowsDirectoryA
InitializeCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
Sleep
lstrcmpiA
LoadLibraryW
GetProcAddress
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
wsock32
ioctlsocket
inet_addr
comdlg32
GetOpenFileNameW
user32
DestroyIcon
GetSystemMetrics
LoadIconA
PostMessageA
SetFocus
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SysAllocStringLen
SysFreeString
scecli
SceStartTransaction
SceGetDatabaseSetting
InitializeChangeNotify
SceRollbackTransaction
SceDcPromoCreateGPOsInSysvolEx
SceAddToNameStatusList
SceSetupUpdateSecurityFile
SceGetObjectChildren
SceIsSystemDatabase
SceEnforceSecurityPolicyPropagation
SceWriteSecurityProfileInfo
advpack
ExtractFiles
OpenINFEngine
Sections
UPX1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Y Size: 512B - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qvae Size: 4KB - Virtual size: 419KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.T Size: 2KB - Virtual size: 550KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 139KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tiFp Size: 512B - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aqJji Size: 3KB - Virtual size: 471KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ