Behavioral task
behavioral1
Sample
b47f7982fdbb84bdeb56ceb08483ad8e_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
b47f7982fdbb84bdeb56ceb08483ad8e_JaffaCakes118
-
Size
308KB
-
MD5
b47f7982fdbb84bdeb56ceb08483ad8e
-
SHA1
530b26f3ccb48f41dfc5f7869fcd3b3c33eeedd4
-
SHA256
4deed119a94dcdfbe63854ef556b991bd5e16d672fcb3f7f381239e8ecc563ab
-
SHA512
c632d3c89704b5b32f4e429e2288de2fa573d981be947f351bfab743c1d543172f6bb8aa2c17a22e2fc8d30fcf4a2006274da30feec61c8fc695079e6a03ea9d
-
SSDEEP
6144:4t3Q8yxQJNy9u4mKIWrigyHruyD21rjR84EyaIwL2+ClwHyR0fSYW1mjP5MGMboh:4tFyxo5bWrilruyKxO7fLL2+CWdSYX
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b47f7982fdbb84bdeb56ceb08483ad8e_JaffaCakes118
Files
-
b47f7982fdbb84bdeb56ceb08483ad8e_JaffaCakes118.exe windows:4 windows x86 arch:x86
e7f14bbda50f76c1622863574f64d125
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
advapi32
LsaClose
crypt32
CryptUnprotectData
ole32
CoTaskMemFree
oleaut32
SysFreeString
pstorec
PStoreCreateInstance
rasapi32
RasEnumEntriesA
shell32
SHGetSpecialFolderPathA
user32
ToAscii
Sections
UPX0 Size: - Virtual size: 104KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 278KB - Virtual size: 288KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rorg Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE