Behavioral task
behavioral1
Sample
afd8751d85c71ebc15e14987cea09443_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
afd8751d85c71ebc15e14987cea09443_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
afd8751d85c71ebc15e14987cea09443_JaffaCakes118
-
Size
44KB
-
MD5
afd8751d85c71ebc15e14987cea09443
-
SHA1
e088c7efe402c4527f3e311fd71353d670b44829
-
SHA256
ea19fdfd83be885f870f5a620f38845ef2bce3308e472e79eb142226a29c3da6
-
SHA512
704e501c034e92079675da71217155e26719893e794aba22b1a02901de01b058c716d3752b6ca4c79436eec985b5aa44fc9f68341a8ddea00d4de202c6e8866e
-
SSDEEP
384:NOckepXqE1pS/1szxm+9Y12vZYilnsl3NMqL:EepXqkS/1szxhigdl7Q
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource afd8751d85c71ebc15e14987cea09443_JaffaCakes118
Files
-
afd8751d85c71ebc15e14987cea09443_JaffaCakes118.exe windows:4 windows x86 arch:x86
0161edef61db369e11b735821cbaa4e9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WinExec
SetFilePointer
ReadFile
GetTempPathA
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetCurrentThreadId
GetStartupInfoA
GetModuleFileNameA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
urlmon
URLDownloadToFileA
user32
GetKeyboardType
MessageBoxA
CharNextA
wsock32
WSACleanup
WSAStartup
gethostname
gethostbyname
inet_ntoa
Sections
UPX0 Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE