Behavioral task
behavioral1
Sample
d5334b120d899b68871b5a08adf5f0b0_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d5334b120d899b68871b5a08adf5f0b0_JaffaCakes118
-
Size
440KB
-
MD5
d5334b120d899b68871b5a08adf5f0b0
-
SHA1
05bfd1b38578e72bc0f645603d5f9175d39a9f0c
-
SHA256
c647fdf476d96894ef478dc0cdead72d7c1f91c84d76d262ffe0634119808dc8
-
SHA512
ac986f02d8201bf43cc672ebea834c9af41d288bc5d91ca1efa47c83ddc0bd2299d603bf7cf79ab5d353fd183bfd0848f76ae722c3639f0a8bd87934b4ddd30b
-
SSDEEP
12288:n3VrI43zS3T+BQDOniIIQJXLPT4AI30gO:nFrIAg6B5iOPxI30g
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d5334b120d899b68871b5a08adf5f0b0_JaffaCakes118
Files
-
d5334b120d899b68871b5a08adf5f0b0_JaffaCakes118.exe windows:4 windows x86 arch:x86
1f3f826adeb11778c764717763732eb1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSAAccept
kernel32
GetThreadLocale
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
RegisterClipboardFormatA
MessageBoxA
gdi32
RectVisible
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
advapi32
LookupPrivilegeValueA
shell32
Shell_NotifyIconA
comctl32
ord17
oledlg
ord8
ole32
StgCreateDocfileOnILockBytes
olepro32
ord253
oleaut32
VariantChangeType
wininet
HttpOpenRequestA
wsock32
WSAStartup
netapi32
Netbios
rpcrt4
UuidCreate
iphlpapi
GetIpNetTable
Sections
.text Size: - Virtual size: 385KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 428KB - Virtual size: 427KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ