Behavioral task
behavioral1
Sample
e1841a0ca6e0b835710036bd9cb9cef6_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
e1841a0ca6e0b835710036bd9cb9cef6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e1841a0ca6e0b835710036bd9cb9cef6_JaffaCakes118
-
Size
714KB
-
MD5
e1841a0ca6e0b835710036bd9cb9cef6
-
SHA1
26f70692398f6b65ec2d6b47ef57d2d13a0dea04
-
SHA256
416775a2ae43b2b548c29eedec9a98f6d9a747a58ff0c2c349dbf0f93b433f8e
-
SHA512
7dd7ca9b1bec878c8948d5229cf059e9fb9253befbd4b64fbad6150e2abde6c5b40f46d91ef51e44df7041b39fa33890705b4bd2fdfcff30faa05028495d2087
-
SSDEEP
12288:l8Pq0WcMBHWFcA1CFwIg1pb/SFJ5nGo/L9ZCtPraOtTsnb7wZiQEwHkh:90WcMB26A1CFclSFJpb/LuNs3wkQEwEh
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e1841a0ca6e0b835710036bd9cb9cef6_JaffaCakes118
Files
-
e1841a0ca6e0b835710036bd9cb9cef6_JaffaCakes118.exe windows:4 windows x86 arch:x86
3989287d6281b95f4e8a82493ddb9b3c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
CharNextA
advapi32
RegCloseKey
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
SaveDC
ole32
CoInitialize
comctl32
ImageList_Add
shell32
ShellExecuteA
msimg32
GradientFill
hardwareid
GetCPUID
Sections
.UPX1 Size: 637KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lame Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. Size: 115B - Virtual size: 115B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ