Behavioral task
behavioral1
Sample
b18e6f7a40820ea4c55d4b53189a71b7_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b18e6f7a40820ea4c55d4b53189a71b7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b18e6f7a40820ea4c55d4b53189a71b7_JaffaCakes118
-
Size
141KB
-
MD5
b18e6f7a40820ea4c55d4b53189a71b7
-
SHA1
3e2bb21a78be8e62d3604b0de362317d3c4fcdfe
-
SHA256
860c8b35dd5dc2450b7c1f4e4bfce05348db6578def29ff2e486faa31cf7b349
-
SHA512
db1b41ac8cf0be247c5d65166e980d2ae2c01e393d2dd2169b5df944a7a55207c70324460c929050349f6b1e177c019b16345df6fa1a6abad582aa940bc9cb92
-
SSDEEP
3072:itrhDUHueQKgP+mx/1Wf0WaonyoHLJdsgJr3uNhTUjfS89:IrlUOTh+mx/1M0WakyoHL4Cr3uNlcfb
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b18e6f7a40820ea4c55d4b53189a71b7_JaffaCakes118
Files
-
b18e6f7a40820ea4c55d4b53189a71b7_JaffaCakes118.exe windows:4 windows x86 arch:x86
a628a0f19a56032b922188f29fffae98
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalLock
lstrlenW
ReadFile
WriteFile
FindClose
FindFirstFileA
GlobalUnlock
CreateFileA
SetFileAttributesA
GetFileAttributesA
MultiByteToWideChar
WideCharToMultiByte
EnumSystemCodePagesA
GetModuleHandleA
GetModuleFileNameA
CreateProcessA
CloseHandle
GetLocaleInfoA
lstrcmpA
lstrlenA
lstrcpynA
GetFullPathNameA
GetProcessHeap
HeapAlloc
ExitProcess
lstrcpyA
HeapFree
LoadLibraryA
GetProcAddress
GetLastError
SetFilePointer
FreeLibrary
GetStartupInfoA
user32
GetKeyboardLayoutNameA
DefWindowProcA
GetKeyState
ClientToScreen
EnableMenuItem
TrackPopupMenu
CheckMenuItem
GetWindowLongA
ActivateKeyboardLayout
EnableWindow
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
LoadAcceleratorsA
UpdateWindow
GetMessageA
TranslateAcceleratorA
SetDlgItemTextA
GetDlgItemInt
MessageBoxA
SetDlgItemInt
TranslateMessage
DispatchMessageA
GetWindowTextLengthA
GetWindowTextA
GetDlgItem
EndDialog
InvalidateRect
DialogBoxParamA
PostMessageA
EnumClipboardFormats
GetClipboardData
CloseClipboard
HideCaret
SetWindowTextA
ShowCaret
GetKeyboardLayoutList
DeleteMenu
AppendMenuA
FindWindowA
GetParent
SetForegroundWindow
ShowWindow
SetFocus
SendMessageA
GetWindowRect
MoveWindow
DestroyWindow
PostQuitMessage
GetMenu
GetSubMenu
LoadMenuA
RegisterWindowMessageA
GetClientRect
OpenClipboard
gdi32
DeleteObject
GetDeviceCaps
StartDocA
EndPage
StartPage
EndDoc
DeleteDC
CreateFontIndirectA
GetStockObject
GetObjectA
advapi32
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
shell32
DragAcceptFiles
DragQueryFileA
ShellExecuteA
comctl32
ord17
comdlg32
ChooseFontA
PrintDlgA
PageSetupDlgA
GetSaveFileNameA
GetOpenFileNameA
ChooseColorA
msvcrt
__p__commode
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
atoi
strchr
memcmp
toupper
strncpy
strlen
strncat
strcmp
memchr
memmove
memcpy
strcpy
memset
sprintf
printf
__p__fmode
__set_app_type
_except_handler3
_controlfp
_adjust_fdiv
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 293KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 104KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE