Behavioral task
behavioral1
Sample
d349a783ceafd95cbbc8b635eaaedace_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d349a783ceafd95cbbc8b635eaaedace_JaffaCakes118
-
Size
39KB
-
MD5
d349a783ceafd95cbbc8b635eaaedace
-
SHA1
e7850df8f5cad172e6aa8addf4d517b429cefcaa
-
SHA256
dfa1cab89883509cf44fddea39e1ab912ba0c4a2389c6ea59103693487477588
-
SHA512
ed9d66d429cba41e4c93582745f2d5dc06e5f42e666f4f13889d49f25547f52d1ede12c3b0d83656594558df7fda5365a1f757799b429ab3a3c1587a8cca0286
-
SSDEEP
384:hqBv0ndudWBoCM7ermHVCpW3eQTJymC1RqoxaGVRMBrD5ausuwvTG5ZXXIntm7Z8:O0Id2u79HVxe6smmgGXMBr9ivTGPF7Z
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d349a783ceafd95cbbc8b635eaaedace_JaffaCakes118
Files
-
d349a783ceafd95cbbc8b635eaaedace_JaffaCakes118.exe windows:4 windows x86 arch:x86
7b99271f710220f8745178498229cca8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
CreateThread
GetCurrentProcess
lstrcpynA
GetProcAddress
GetModuleHandleA
FreeLibrary
GlobalFree
LoadLibraryExA
GlobalAlloc
VirtualProtect
FlushInstructionCache
LoadLibraryA
GetThreadLocale
InitializeCriticalSection
WriteProcessMemory
CreateRemoteThread
OpenProcess
FindClose
FindFirstFileA
ExitProcess
DeleteCriticalSection
WideCharToMultiByte
MoveFileExA
RaiseException
LocalAlloc
GetProcessHeap
HeapAlloc
DeleteFileA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
MultiByteToWideChar
GetLastError
SetLastError
GetVersionExA
GetLocaleInfoA
GetACP
InterlockedExchange
Sleep
GetFileSize
ReadFile
lstrcmpA
lstrcatA
CreateFileA
CloseHandle
lstrcpyA
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetTickCount
lstrlenA
GetModuleFileNameA
WriteFile
advapi32
SetEntriesInAclA
RegCloseKey
RegSetValueExA
RegDeleteValueA
GetSecurityInfo
OpenProcessToken
SetSecurityInfo
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
crypt32
CertOpenSystemStoreA
CertCloseStore
PFXExportCertStore
gdi32
GetDeviceCaps
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt
GetDIBColorTable
DeleteObject
DeleteDC
CreateDCA
ole32
CoInitialize
CoCreateInstance
user32
wsprintfA
CharUpperA
userenv
GetUserProfileDirectoryA
wininet
FindCloseUrlCache
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
InternetOpenUrlA
InternetCloseHandle
HttpQueryInfoA
InternetQueryOptionA
FindNextUrlCacheEntryA
InternetReadFile
HttpOpenRequestA
HttpAddRequestHeadersA
InternetOpenA
InternetSetStatusCallback
InternetConnectA
Sections
UPX0 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE