Behavioral task
behavioral1
Sample
8e10a14cbe1e56a661adc949cf47bf14_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
8e10a14cbe1e56a661adc949cf47bf14_JaffaCakes118
-
Size
259KB
-
MD5
8e10a14cbe1e56a661adc949cf47bf14
-
SHA1
b3610d061a0bf20b9a2d9ca8df65264a09e302a2
-
SHA256
2d025cfe3885c849385f070d9267abddf4015d1bb977f7a104f3cfbabad3b21a
-
SHA512
7353f697d7f04b34da10a23e70e0c04bd361dc818137c8e168bbf0929ab410d8373d5afa160a161d9b3010dfe1ab99a661ccbf0da79c9c8b3f60a4133ebb4f83
-
SSDEEP
6144:HTWe9o2bxVyFWkZzJxtejEfWZDkThADnmJRrtZB59:zXoImYuzheQWZAZ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e10a14cbe1e56a661adc949cf47bf14_JaffaCakes118
Files
-
8e10a14cbe1e56a661adc949cf47bf14_JaffaCakes118.exe windows:4 windows x86 arch:x86
0fee85a1ecfb1030eb55b9e28b61941d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetLastError
GetTickCount
GetCurrentProcess
MultiByteToWideChar
GetSystemDirectoryW
GetVersionExA
GetProcessHeap
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
HeapCreate
ExitProcess
GetModuleFileNameA
GetEnvironmentStringsW
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
GetProcAddress
user32
GetSystemMetrics
LoadMenuIndirectA
GetDlgItemTextA
TrackPopupMenu
RegisterClassW
GetKeyboardType
SetCursor
IsMenu
RegisterWindowMessageA
InvalidateRect
SendDlgItemMessageW
CharLowerW
wsprintfA
GetDlgItemInt
WinHelpW
MessageBoxW
DialogBoxParamW
LoadBitmapW
GetSubMenu
DialogBoxIndirectParamW
GetMenuItemInfoA
GetIconInfo
ShowCursor
wvsprintfW
EmptyClipboard
InvalidateRgn
CheckMenuItem
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
mssip32
CryptSIPGetSignedDataMsg
CryptSIPGetRegWorkingFlags
gdi32
DeleteObject
CreateICA
CreateDIBPatternBrush
GetEnhMetaFileW
GetEnhMetaFileA
SetMetaFileBitsEx
CreateScalableFontResourceA
CreateFontW
CreatePen
CreateCompatibleDC
GdiGetBatchLimit
AddFontResourceA
CreateRectRgn
CreatePatternBrush
CreateDIBPatternBrushPt
filemgmt
DllGetClassObject
DllCanUnloadNow
DllRegisterServer
CacheSettingsDlg
Sections
UPX1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.c Size: 5KB - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 75KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.RvaZz Size: 5KB - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 138KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.C Size: 3KB - Virtual size: 559KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.WurWBH Size: 3KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ