Behavioral task
behavioral1
Sample
bb77c476d64e122565f7b260ce795853_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bb77c476d64e122565f7b260ce795853_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bb77c476d64e122565f7b260ce795853_JaffaCakes118
-
Size
282KB
-
MD5
bb77c476d64e122565f7b260ce795853
-
SHA1
50466dea62a6a993b40b92da753302042ee2b1a3
-
SHA256
1e88d616f3474949eb792fa55cbc3581e1bbf2c3b9797de3f9032b22afcb277c
-
SHA512
ba3373863c73cc51eb7731cd682362e80cea58f82b3f539ee1e6376a082e12b774d0cc53046f582f8e5b16f267857802ce4e7b3e122b858a9b2eae142ed6bda1
-
SSDEEP
6144:EZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF1M:wFTxWYMh5qoLb8LCy9E
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bb77c476d64e122565f7b260ce795853_JaffaCakes118
Files
-
bb77c476d64e122565f7b260ce795853_JaffaCakes118.exe windows:4 windows x86 arch:x86
913a4a367a3cc426f8f8ac8fe6743a43
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AllocateAndInitializeSid
EqualSid
FreeSid
GetTokenInformation
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
kernel32
FileTimeToSystemTime
FreeLibrary
GetCurrentProcess
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcessHeap
GetSystemDirectoryA
GetVersion
GetVersionExA
GetWindowsDirectoryA
InitializeCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
Sleep
lstrcmpiA
LoadLibraryW
GetProcAddress
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
wsock32
ioctlsocket
inet_addr
comdlg32
GetOpenFileNameW
user32
DestroyIcon
GetSystemMetrics
LoadIconA
PostMessageA
SetFocus
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SysAllocStringLen
SysFreeString
scecli
SceStartTransaction
SceGetDatabaseSetting
InitializeChangeNotify
SceRollbackTransaction
SceDcPromoCreateGPOsInSysvolEx
SceAddToNameStatusList
SceSetupUpdateSecurityFile
SceGetObjectChildren
SceIsSystemDatabase
SceEnforceSecurityPolicyPropagation
SceWriteSecurityProfileInfo
advpack
ExtractFiles
OpenINFEngine
Sections
UPX1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Y Size: 512B - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qvae Size: 4KB - Virtual size: 419KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.T Size: 2KB - Virtual size: 550KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 139KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tiFp Size: 512B - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aqJji Size: 3KB - Virtual size: 471KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ