Behavioral task
behavioral1
Sample
949c8f307f335c9d26386e2a5af938b9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
949c8f307f335c9d26386e2a5af938b9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
949c8f307f335c9d26386e2a5af938b9_JaffaCakes118
-
Size
66KB
-
MD5
949c8f307f335c9d26386e2a5af938b9
-
SHA1
cf073a048a5a9cd48105ce0ecb322457b67309d9
-
SHA256
d74bbb3aff4ac98e26075d2fec8d73696db4238840886ed27de1feb59909b891
-
SHA512
d6935cc2a622f4159d0f40f1577ed83f176addb6ebc52e897e02a2026244ff3f6f7aec1eeefa41efaf302ff417520d9e4b7ece230312bb7d66669329764c67d1
-
SSDEEP
384:9RUycqc5QqPkB2F8NaJ/ld1KeFV7iZ3qBdDtPJrqd9VfXZ4iS0HHrs/S2pO0T82e:cycqQQVFeKkAsPlqRSdz6eIQWz
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 949c8f307f335c9d26386e2a5af938b9_JaffaCakes118
Files
-
949c8f307f335c9d26386e2a5af938b9_JaffaCakes118.exe windows:4 windows x86 arch:x86
f14aa75148b4dfa333941602c8e60e11
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
CreateToolhelp32Snapshot
Process32Next
Process32First
Thread32First
OpenThread
Thread32Next
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
lstrcmpiA
VirtualFree
VirtualAlloc
SuspendThread
SizeofResource
OpenProcess
LockResource
LoadResource
GetWindowsDirectoryA
GetTempPathA
GetLastError
GetCurrentThreadId
FreeResource
FindResourceA
DuplicateHandle
DeleteFileA
CreateDirectoryA
CopyFileA
CloseHandle
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ntdll
DbgUiConnectToDbg
DbgUiDebugActiveProcess
ZwQuerySystemInformation
ZwQueryInformationProcess
shell32
ShellExecuteA
user32
GetKeyboardType
MessageBoxA
CharNextA
Sections
UPX0 Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE