Behavioral task
behavioral1
Sample
ebc2b31d5bb6d2099d7b9242c28a48a7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ebc2b31d5bb6d2099d7b9242c28a48a7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ebc2b31d5bb6d2099d7b9242c28a48a7_JaffaCakes118
-
Size
263KB
-
MD5
ebc2b31d5bb6d2099d7b9242c28a48a7
-
SHA1
c896eea59620afb474468463670ed11fe9fd4eea
-
SHA256
7fdf4d9ed6c86ddd8ebfa7e3ec6eb77fc0a612839039cacc84dbfa244ec31f92
-
SHA512
4b9c7bb0174002a7487b0dc1b96803977ffc532a0209edd8ef937c0bce2b53d48a99ab9a6029703ad8fdba36430a186b40a5c9f8d3020ad69fbe1944d0effa14
-
SSDEEP
6144:LbV1mlxAN/u3wGn/c6PYuyJIc907ohkotjQX1kZrrnQ:LBMWVugGn/ftyd9UoCotjQmQ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ebc2b31d5bb6d2099d7b9242c28a48a7_JaffaCakes118
Files
-
ebc2b31d5bb6d2099d7b9242c28a48a7_JaffaCakes118.exe windows:4 windows x86 arch:x86
1645a2aac5536a39aadd46fdfaae2ce6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
IsBadWritePtr
GetOEMCP
GetSystemInfo
GetCPInfo
GetLocaleInfoA
GetEnvironmentStringsW
QueryPerformanceCounter
HeapCreate
GetStartupInfoA
GetModuleHandleA
ExitProcess
GetStringTypeW
GetStringTypeA
GetVersionExA
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread
LocalFree
MultiByteToWideChar
GetLastError
FreeLibrary
GetModuleFileNameA
InitializeCriticalSection
GetVolumeInformationW
GetModuleHandleW
GetCurrentProcess
GetACP
GetProcAddress
advapi32
AdjustTokenPrivileges
OpenProcessToken
AccessCheck
DuplicateToken
OpenThreadToken
GetFileSecurityA
MapGenericMask
LookupPrivilegeValueA
msasn1
ASN1BEREncCheck
ASN1BERDecZeroChar32String
ASN1BERDecSkip
ASN1_Encode
ASN1CEREncChar32String
ASN1_CloseModule
ASN1BERDecObjectIdentifier2
ASN1CEREncGeneralizedTime
ASN1intx_sub
ASN1BERDecOctetString
ASN1charstring_free
mfc42u
DllUnregisterServer
Sections
UPX0 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gi Size: 3KB - Virtual size: 416KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nBw Size: 1024B - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Tm Size: 3KB - Virtual size: 529KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 97KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ayCmb Size: 4KB - Virtual size: 539KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 118KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rYGELK Size: 2KB - Virtual size: 459KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ