Behavioral task
behavioral1
Sample
bbfbed6628ef8c7aee1dc3575e807000_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
bbfbed6628ef8c7aee1dc3575e807000_JaffaCakes118
-
Size
1.8MB
-
MD5
bbfbed6628ef8c7aee1dc3575e807000
-
SHA1
e77c0e1a22c82781795e2fd2209774d3137f1617
-
SHA256
03a109a2f0aa33b78c4b37cb9c7696d76739de81d88e7192f3b88c07a01c74db
-
SHA512
17a7ae660f584c5db0646de802dfd68f71eac4c08402531e81e104ce21466d75d5bbd1a52120842490bb6bffc529ecd3c58c7ce09056099a8837e62badcf1310
-
SSDEEP
49152:rWIGAqQ6x8sqK6cKv+Am/jYOU4H7x+jWttcES:rBHWx8TajYOFwj/
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bbfbed6628ef8c7aee1dc3575e807000_JaffaCakes118
Files
-
bbfbed6628ef8c7aee1dc3575e807000_JaffaCakes118.exe windows:4 windows x86 arch:x86
f7fe0f4958674503ed17bbbe1adaf7e1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReadFile
GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 812KB - Virtual size: 810KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ