Behavioral task
behavioral1
Sample
ad6e39a6f740aba82f3042a56d663ba8_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ad6e39a6f740aba82f3042a56d663ba8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ad6e39a6f740aba82f3042a56d663ba8_JaffaCakes118
-
Size
250KB
-
MD5
ad6e39a6f740aba82f3042a56d663ba8
-
SHA1
d1180687c74aaed808724253359891a01cef8a9b
-
SHA256
753fcca021fa6185a118587d5f2307f2b43909c4f5f20c447ca340fc8e4b611a
-
SHA512
f82c1483d1e21394184ef346f7ef09b3560c7ef786a2bc9dec31d923b573d68290fcd938df0984259ee1a5aec730c361fd9f13d6798501ac78074fa6dc5b0026
-
SSDEEP
6144:qZ/4UHB0CnKk/T7J6bdULh3VvKsO5GTHYjlzIS:8Kk/TCdULxViZ5GrYjlzx
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad6e39a6f740aba82f3042a56d663ba8_JaffaCakes118
Files
-
ad6e39a6f740aba82f3042a56d663ba8_JaffaCakes118.exe windows:4 windows x86 arch:x86
ee1f3aa89716293e7f70a15ad6bb3168
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetLastError
GetTickCount
GetCurrentProcess
MultiByteToWideChar
GetSystemDirectoryW
GetVersionExA
GetProcessHeap
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
HeapCreate
ExitProcess
GetModuleFileNameA
GetEnvironmentStringsW
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
GetModuleHandleW
GetProcAddress
user32
GetSystemMetrics
MessageBoxIndirectA
GetMenuItemRect
CreateDialogParamW
CharUpperA
PostQuitMessage
CharNextA
PostMessageA
GetTopWindow
GetIconInfo
EnumWindows
FindWindowW
DialogBoxParamW
SetCursor
SetDlgItemTextW
LoadImageA
CreateAcceleratorTableW
GetMenuStringA
DialogBoxIndirectParamW
wsprintfW
GetSubMenu
RegisterClassW
CopyIcon
SetActiveWindow
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
usp10
ScriptGetProperties
ScriptFreeCache
ScriptItemize
ScriptTextOut
ScriptString_pcOutChars
ScriptIsComplex
ScriptStringGetLogicalWidths
ScriptApplyDigitSubstitution
UspAllocCache
gdi32
RemoveFontResourceExW
CreateFontA
UpdateICMRegKeyA
CreatePolyPolygonRgn
RemoveFontResourceA
CreateScalableFontResourceW
CreateDIBPatternBrushPt
filemgmt
DllGetClassObject
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 1024B - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 79KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CODE Size: 512B - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 141KB - Virtual size: 237KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ