Behavioral task
behavioral1
Sample
bac9d8042585ed93a50f8772b2f7cfd8_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bac9d8042585ed93a50f8772b2f7cfd8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bac9d8042585ed93a50f8772b2f7cfd8_JaffaCakes118
-
Size
457KB
-
MD5
bac9d8042585ed93a50f8772b2f7cfd8
-
SHA1
ef755db093437dda646f5fe2e06e442984c87b8c
-
SHA256
85d8ed97458e015514fe01e8ceb860015ccd9961656200430da793d866001c7f
-
SHA512
528401e0637d35fdf3e7c4e7d07824f85236029ef4dac9cd47baff6d03d0844606eb5b3fa8b3cdad6f44ad0e115f85252238676a782f611d050328c12861d006
-
SSDEEP
12288:9tZCTjBR/uENpqb+XyBbNAgkoVlILR5tfrNpK9Vn:/ZCRk8XyBqQeJNgVn
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bac9d8042585ed93a50f8772b2f7cfd8_JaffaCakes118
Files
-
bac9d8042585ed93a50f8772b2f7cfd8_JaffaCakes118.exe windows:5 windows x86 arch:x86
2ba8e88bd9f8eb450750fe7d0ea34bda
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
FreeSid
kernel32
EnumResourceLanguagesA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess
gdi32
GetDeviceCaps
user32
ShowWindow
MessageBoxA
comctl32
ord17
version
GetFileVersionInfoA
Sections
.text Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 451KB - Virtual size: 450KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ