Behavioral task
behavioral1
Sample
b5a8f212cd34b5a962eeafd424f8e2fa_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
b5a8f212cd34b5a962eeafd424f8e2fa_JaffaCakes118
-
Size
259KB
-
MD5
b5a8f212cd34b5a962eeafd424f8e2fa
-
SHA1
407b3922abd556155d6fb14788dd5f253d09c002
-
SHA256
3326a630959a43ade73cbf05f8764e4e325422caa12d4c6055ce41b36a7c42b7
-
SHA512
33c17cc7d5f5cc5142da02771f4c1cfbf26a0291cf59e3841089002d15d44ba17e8671e6b9972b5ad51bd4c336b4d0f516b2f0c2a4895671649e43d9f3596102
-
SSDEEP
6144:jTWe9o2bxVyFWkZzJxtejEfWZDkThADnmJRrtZB59:/XoImYuzheQWZAZ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b5a8f212cd34b5a962eeafd424f8e2fa_JaffaCakes118
Files
-
b5a8f212cd34b5a962eeafd424f8e2fa_JaffaCakes118.exe windows:4 windows x86 arch:x86
0fee85a1ecfb1030eb55b9e28b61941d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetLastError
GetTickCount
GetCurrentProcess
MultiByteToWideChar
GetSystemDirectoryW
GetVersionExA
GetProcessHeap
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
HeapCreate
ExitProcess
GetModuleFileNameA
GetEnvironmentStringsW
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
GetProcAddress
user32
GetSystemMetrics
LoadMenuIndirectA
GetDlgItemTextA
TrackPopupMenu
RegisterClassW
GetKeyboardType
SetCursor
IsMenu
RegisterWindowMessageA
InvalidateRect
SendDlgItemMessageW
CharLowerW
wsprintfA
GetDlgItemInt
WinHelpW
MessageBoxW
DialogBoxParamW
LoadBitmapW
GetSubMenu
DialogBoxIndirectParamW
GetMenuItemInfoA
GetIconInfo
ShowCursor
wvsprintfW
EmptyClipboard
InvalidateRgn
CheckMenuItem
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
mssip32
CryptSIPGetSignedDataMsg
CryptSIPGetRegWorkingFlags
gdi32
DeleteObject
CreateICA
CreateDIBPatternBrush
GetEnhMetaFileW
GetEnhMetaFileA
SetMetaFileBitsEx
CreateScalableFontResourceA
CreateFontW
CreatePen
CreateCompatibleDC
GdiGetBatchLimit
AddFontResourceA
CreateRectRgn
CreatePatternBrush
CreateDIBPatternBrushPt
filemgmt
DllGetClassObject
DllCanUnloadNow
DllRegisterServer
CacheSettingsDlg
Sections
UPX1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.c Size: 5KB - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 75KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.RvaZz Size: 5KB - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 138KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.C Size: 3KB - Virtual size: 559KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.WurWBH Size: 3KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ