Behavioral task
behavioral1
Sample
9663a5bdd411a55d4625ed5acda0cab0_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
9663a5bdd411a55d4625ed5acda0cab0_JaffaCakes118
-
Size
157KB
-
MD5
9663a5bdd411a55d4625ed5acda0cab0
-
SHA1
b3bfff47435aec89b9d357cc406ca817b43c12b6
-
SHA256
0dd6f9334fc553873960dfe9ee17a87ccee38829772e2031bcf8ba86ebd23aeb
-
SHA512
e9b53e81eded115cbe1c5f621caec843f09e6e2237a995e1011adb7a7d05208f98854503e8c96fcbba6ab362a47f5e00036326139d5c8dd18795cdb31919d272
-
SSDEEP
3072:oMrCRK8sOMJKy1HU0L+WXukWtcurZ2zIHQjiV1jnDQ/JvMKdnd:oCCCOo100LnyaIwjsk/RMId
Malware Config
Signatures
-
resource yara_rule sample themida -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9663a5bdd411a55d4625ed5acda0cab0_JaffaCakes118
Files
-
9663a5bdd411a55d4625ed5acda0cab0_JaffaCakes118.exe windows:5 windows x86 arch:x86
6b9cc2522fbfe1b135277718414678c4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlUnwind
_stricmp
strncpy
NtSetInformationProcess
msvcrt
__p__fmode
__set_app_type
_controlfp
__p__commode
_exit
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
kernel32
GetStartupInfoA
RemoveVectoredExceptionHandler
CreateJobObjectA
SetInformationJobObject
AssignProcessToJobObject
CloseHandle
WaitForSingleObject
LoadLibraryA
FreeLibrary
GetModuleHandleA
GetVersionExA
user32
GetActiveWindow
GetWindowDC
ReleaseDC
gdi32
LineTo
ole32
CoInitialize
Sections
.data Size: 512B - Virtual size: 596B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.u Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_WRITE
.aspack Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
themida Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE