Behavioral task
behavioral1
Sample
d61ebc8c89568680be99d3da33317efa_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d61ebc8c89568680be99d3da33317efa_JaffaCakes118
-
Size
1.4MB
-
MD5
d61ebc8c89568680be99d3da33317efa
-
SHA1
5ded1c097827f654577e721aa4a8fd4a94956614
-
SHA256
e995184c83d461301f8dda6038720dd24ccf30657a1c180357f8a2243d896ffa
-
SHA512
2c12e133de76697bd11507d391421d977b8c0281f40a26405d6769fd4556cca90c8beec7b27828ac4b9a9e3103ef6a584ffda6a9e965caf601b55a2141dce45d
-
SSDEEP
24576:6PIVywrNOkn/F5tOh9ZbC3TyBtwOQxTmLouQJfP4W4pxFn:6PwrNpn/F58FqToA6MJYvn
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d61ebc8c89568680be99d3da33317efa_JaffaCakes118
Files
-
d61ebc8c89568680be99d3da33317efa_JaffaCakes118.exe windows:4 windows x86 arch:x86
566fdbc4615177c8eaa0f52807d1b53f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
kernel32
GetFileSize
GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess
user32
BeginPaint
MessageBoxA
gdi32
LPtoDP
winmm
midiStreamStop
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
comdlg32
ChooseColorA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
CoRevokeClassObject
oleaut32
RegisterTypeLi
comctl32
ord17
oledlg
ord8
ws2_32
WSAAsyncSelect
Sections
.text Size: - Virtual size: 547KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 426KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ