Behavioral task
behavioral1
Sample
c23284cd01791c9e301bd698188a23e2_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
c23284cd01791c9e301bd698188a23e2_JaffaCakes118
-
Size
2.0MB
-
MD5
c23284cd01791c9e301bd698188a23e2
-
SHA1
b76cfa0be825b3bdf8cd029404088ea61c979e45
-
SHA256
765754193ff36c1b02f15bfceddff48514b008e47480cffab66ce24febc93a52
-
SHA512
031f312286f65d09286b61ec5db529c5e1843f85a36ed66fa566505d261179c2fdb99f8814375301b8537da940691413e13df61741993667f2416b7a1205c42a
-
SSDEEP
49152:Wdc1aDr4Q3ogKlGs15ViZLjOwNF6OyZCRn/p+nUKvBfi8Cq2Pb:MccDr4Q3G0s/SjOagOyZ2/p+nUKpaRvP
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c23284cd01791c9e301bd698188a23e2_JaffaCakes118
Files
-
c23284cd01791c9e301bd698188a23e2_JaffaCakes118.exe windows:4 windows x86 arch:x86
69cb1048b82d6768039999032cfe09c4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
kernel32
GetThreadLocale
GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess
user32
LoadStringA
MessageBoxA
gdi32
MoveToEx
winmm
midiOutReset
msimg32
GradientFill
winspool.drv
ClosePrinter
comdlg32
ChooseColorA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
SafeArrayAccessData
comctl32
ord17
oledlg
ord8
ws2_32
accept
Sections
.text Size: - Virtual size: 547KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 422KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ