Behavioral task
behavioral1
Sample
e24304870bbfb886a544a402de0df13d_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
e24304870bbfb886a544a402de0df13d_JaffaCakes118
-
Size
972KB
-
MD5
e24304870bbfb886a544a402de0df13d
-
SHA1
52a1df7974376945ebec5de505210e48e28f0125
-
SHA256
0bc88dce7bd2519a14b88eb8b6930fd3f50c460cff0fe979feb35e0a4bd13570
-
SHA512
990d5bab15bd189c4d49d5fd339d4d417880c6954c0d8153e193f84691d94b47100ab5e64b8f080b90ae8e4118230a5b3790fadcc3c931532ee4f3e2351fee45
-
SSDEEP
12288:qD7lxfXgiYDqi3MAxGQ3BdOukFfY+F1ldsui3hBTokB:qjXjYDqgPGQ3BVkpY+F1ldsui37To
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e24304870bbfb886a544a402de0df13d_JaffaCakes118
Files
-
e24304870bbfb886a544a402de0df13d_JaffaCakes118.exe windows:4 windows x86 arch:x86
fd35e4db9753c3fb74671af9bb4e4e64
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
netapi32
NetShareEnum
NetApiBufferFree
mpr
WNetCancelConnection2A
WNetAddConnection2A
kernel32
ResetEvent
LeaveCriticalSection
WaitForMultipleObjects
EnterCriticalSection
GetSystemTime
GetCurrentThreadId
CreateThread
CreateEventA
GetLastError
GetTempPathA
CopyFileA
DeleteFileA
InterlockedIncrement
GetCommandLineA
GetLocalTime
CloseHandle
CreateProcessA
SetEvent
DuplicateHandle
GetCurrentProcess
CreatePipe
GetStdHandle
GetCurrentDirectoryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
Sleep
CreateMutexA
GetLocaleInfoW
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryExA
FormatMessageA
FreeLibrary
WaitForSingleObject
SetEndOfFile
ReadFile
ExitProcess
InterlockedExchange
LoadLibraryA
SetStdHandle
HeapFree
RtlUnwind
RaiseException
GetProcAddress
GetModuleHandleA
TerminateProcess
HeapAlloc
WriteConsoleA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
MultiByteToWideChar
WideCharToMultiByte
GetVersionExA
LCMapStringA
LCMapStringW
GetCPInfo
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
WriteFile
FlushFileBuffers
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
SetFilePointer
CreateFileA
VirtualProtect
GetSystemInfo
VirtualQuery
SetHandleCount
GetFileType
GetStartupInfoA
HeapSize
GetACP
GetOEMCP
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
IsBadReadPtr
IsBadCodePtr
user32
wsprintfA
advapi32
CreateServiceA
ControlService
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
RegConnectRegistryA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
DeleteService
ole32
CoCreateGuid
StringFromGUID2
Sections
.text Size: 88KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 824KB - Virtual size: 822KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ