Behavioral task
behavioral1
Sample
d66ec80499e26accd9bce8269bc8735a_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d66ec80499e26accd9bce8269bc8735a_JaffaCakes118
-
Size
295KB
-
MD5
d66ec80499e26accd9bce8269bc8735a
-
SHA1
d0e59674245a6a872b15f9e9b4163eb72b1ef2f2
-
SHA256
82f73e8b14cb05e49683a9ac5ae364b8a7f53b692725f8130c1a367282e8c90d
-
SHA512
242625b11d128f88fd997f6afc7f63de71db2ad68bee44957f3af72492064abac364a37cab3718df4f0436131086ad63f5af5fee2eb144977a9f8f3ec2adb318
-
SSDEEP
6144:99MKtooy9SHhbKk+8YxU5m1l1hFxeAtRNBlaZ:ng9SBekYtDFRL
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d66ec80499e26accd9bce8269bc8735a_JaffaCakes118
Files
-
d66ec80499e26accd9bce8269bc8735a_JaffaCakes118.exe windows:4 windows x86 arch:x86
a1ec8dce401eba16d45a4f1aa06ebd77
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
VirtualProtect
ExitThread
CreateFileA
WriteFile
CloseHandle
msvcrt
memset
_CIacos
memcmp
_mbsnicmp
_mbsncmp
Sections
UPX0 Size: - Virtual size: 532KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 194KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE