Behavioral task
behavioral1
Sample
be82dcab58adca9c46ba19072db5e450_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
be82dcab58adca9c46ba19072db5e450_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
be82dcab58adca9c46ba19072db5e450_JaffaCakes118
-
Size
135KB
-
MD5
be82dcab58adca9c46ba19072db5e450
-
SHA1
2ec959eaddfc4931b6a128f6352498b4589b6e1e
-
SHA256
59df65cbe65aa61807468c9e28aace164d3e13e7e3daae17554d57ba97a08c61
-
SHA512
a39f8281747712759b93c1215e20cb409b07011c8ad5b08f1883ca6a043fb29a217374058f8d47d2deea5527365b69734cf0502bea2a1cac8582bd192fa2b263
-
SSDEEP
3072:3WccSJAA5gxvWJF7wGrF2H1EpdqXFxoRnZ:mccWAW+vOqVEpd4Ur
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be82dcab58adca9c46ba19072db5e450_JaffaCakes118
Files
-
be82dcab58adca9c46ba19072db5e450_JaffaCakes118.exe windows:4 windows x86 arch:x86
fe6f035bb094aed4bf16aab8cdfbd150
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CopyFileA
Process32Next
Module32Next
GetExitCodeProcess
WaitForSingleObject
Sleep
GetWindowsDirectoryA
Process32First
GetLastError
CreateMutexA
CreateToolhelp32Snapshot
GetModuleFileNameA
CreateThread
WinExec
TerminateProcess
OpenProcess
RaiseException
CompareStringA
CompareStringW
GetCommandLineA
FlushFileBuffers
GetLocaleInfoW
SetStdHandle
SetEnvironmentVariableA
LoadLibraryA
GetOEMCP
GetACP
SetFilePointer
CreateProcessA
CloseHandle
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
GetVersionExA
GetUserDefaultLCID
WideCharToMultiByte
MultiByteToWideChar
HeapAlloc
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapFree
DeleteFileA
GetComputerNameA
GetModuleHandleA
GetStartupInfoA
GetLocaleInfoA
GetVersion
ExitProcess
HeapReAlloc
GetCurrentProcess
LCMapStringA
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
EnumSystemLocalesA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetFileAttributesA
SetUnhandledExceptionFilter
GetProcAddress
HeapSize
SetHandleCount
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStdHandle
GetFileType
WriteFile
IsValidLocale
IsValidCodePage
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
urlmon
URLDownloadToFileA
user32
MessageBoxA
winmm
mciSendStringA
wsock32
htons
select
__WSAFDIsSet
WSAStartup
gethostbyname
inet_addr
send
connect
recv
ntohl
inet_ntoa
socket
closesocket
Sections
UPX0 Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE