Behavioral task
behavioral1
Sample
ea44832d4d01f5335e3ca767b893b5d6_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ea44832d4d01f5335e3ca767b893b5d6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ea44832d4d01f5335e3ca767b893b5d6_JaffaCakes118
-
Size
270KB
-
MD5
ea44832d4d01f5335e3ca767b893b5d6
-
SHA1
8970f1a38aadf27fb2cda9c6141116683e80a958
-
SHA256
0af0d8ac1df67867d95eb4df7890fdbc2dea10fb2e5c08fd3690e27614dabc58
-
SHA512
a3206ffcfbb4aa754ece4d4976f675b24c4b6fbf774fc672d32b5c8b5bd2bd90b36e7dc8f30e573e78d6f9ad8fdb6d3e3425c0d0d08afbdfca614de44c76455c
-
SSDEEP
6144:Ao4NTTsuJ9fTl6gZS/Rf7pZjDdd0Uu6gwS7xBH28Bj:34NfsuJSdhdd0Uu6gw2BH5Bj
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea44832d4d01f5335e3ca767b893b5d6_JaffaCakes118
Files
-
ea44832d4d01f5335e3ca767b893b5d6_JaffaCakes118.exe windows:4 windows x86 arch:x86
c6400dced7b74aaa9f5a124498168dd6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
NdrServerCall2
RpcServerRegisterAuthInfoA
RpcServerUseProtseqEpA
RpcServerRegisterIf
RpcMgmtStopServerListening
RpcServerUnregisterIf
RpcServerInqBindings
RpcBindingVectorFree
RpcServerListen
kernel32
InitializeCriticalSection
GetSystemInfo
WaitForSingleObject
GetVersionExA
CreateEventA
SetEvent
GetCurrentThreadId
HeapCreate
ExitProcess
GetModuleHandleA
GetCurrentProcess
TlsAlloc
GetLastError
GetStartupInfoA
GetModuleFileNameA
GetEnvironmentStringsW
GetACP
GetOEMCP
GetCPInfo
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetProcessHeap
GetProcAddress
advapi32
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
scecli
SceStartTransaction
SceSetupUnwindSecurityFile
SceUpdateSecurityProfile
SceFreeProfileMemory
SceSetupUpdateSecurityKey
SceOpenPolicy
SceSvcSetInformationTemplate
ieaksie
DllRegisterServer
Sections
UPX1 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.kko Size: 3KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gFV Size: 4KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ZVm Size: 512B - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.jzyAY Size: 3KB - Virtual size: 487KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 101KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.IEce Size: 5KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Ir Size: 3KB - Virtual size: 629KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 120KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ