Behavioral task
behavioral1
Sample
e11f51b94c20539211b28372a72e6c4a_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
e11f51b94c20539211b28372a72e6c4a_JaffaCakes118
-
Size
344KB
-
MD5
e11f51b94c20539211b28372a72e6c4a
-
SHA1
8ab07d8aedf06ae00dce2a10a9611a5f6c1be85c
-
SHA256
054660ca694854bb456f81b0bffa5f9fea05e57598624e805058bc8325e4451c
-
SHA512
ff8a15136c9583fd88529d4516278ef85ae5683f3c167ce58771e69a3af3f41273a310f2eb482915a03e72cc78ffc322fbc9df49a0215ba6639a2d2b6ee1b60c
-
SSDEEP
6144:FC5hmxu/wbTAMEddRobo9R4CWYd1Yepq1zShd7fd/93wKHUWHHkbaX:Y5rwb1Emb6CCWYTYfJSZlxXgaX
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e11f51b94c20539211b28372a72e6c4a_JaffaCakes118
Files
-
e11f51b94c20539211b28372a72e6c4a_JaffaCakes118.exe windows:4 windows x86 arch:x86
a8c5fe4c4639e156f0c3d3e317c9cfd4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryA
GetProcAddress
GetCurrentProcessId
GetExitCodeProcess
GetThreadLocale
GetUserDefaultLCID
CreateFileA
GetFileSize
WriteFile
OpenEventA
CreateNamedPipeA
DuplicateHandle
FreeLibrary
GetEnvironmentVariableA
Sections
.rsrc Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 4KB - Virtual size: 704B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 276KB - Virtual size: 296KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 414B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 43B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 4KB - Virtual size: 110B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE