Behavioral task
behavioral1
Sample
a64763eb1ec7bea0eb4b69dbba27e784_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a64763eb1ec7bea0eb4b69dbba27e784_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a64763eb1ec7bea0eb4b69dbba27e784_JaffaCakes118
-
Size
42KB
-
MD5
a64763eb1ec7bea0eb4b69dbba27e784
-
SHA1
7919504d38512c9306df64483202baf786265133
-
SHA256
3321e5580f7a8ab08f9564963969881c00bde4183440766726e0d48cc4a1ba98
-
SHA512
f689031ea17b17dab728152d5f36d994ee311b912f9ee36316d2a8c6468544a0eae784e32d4f7b561b7fad962cafaad47329724ca04d25d3faf10aee8d335170
-
SSDEEP
384:G30gnY5ckfjOamhsS5Af8m5XAR0UWos5juVvYMPDpIAjvy5BTQLW4u0+NSX0eaiM:JOiwrWuXPDpkBTQLW4haSOILAZ0Hw
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a64763eb1ec7bea0eb4b69dbba27e784_JaffaCakes118
Files
-
a64763eb1ec7bea0eb4b69dbba27e784_JaffaCakes118.exe windows:4 windows x86 arch:x86
da2ceca73732240be2d1a78ffd00b476
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CopyFileA
CreateDirectoryA
CreateFileA
CreateMutexA
CreateThread
DeleteFileA
FindResourceA
GetEnvironmentVariableA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetSystemDirectoryA
LocalAlloc
LocalFree
MoveFileA
MoveFileExA
OpenMutexA
ReadFile
SetCurrentDirectoryA
SetFilePointer
Sleep
TerminateProcess
WinExec
WriteFile
lstrcatA
lstrlenA
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteValueA
RegQueryValueExA
RegSetValueExA
imagehlp
CheckSumMappedFile
user32
ExitWindowsEx
GetDlgItem
GetWindowTextA
PostMessageA
EnumWindows
Sections
UPX0 Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE