Behavioral task
behavioral1
Sample
ef6a3806fe854c4619c4020af180d0aa_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ef6a3806fe854c4619c4020af180d0aa_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ef6a3806fe854c4619c4020af180d0aa_JaffaCakes118
-
Size
22KB
-
MD5
ef6a3806fe854c4619c4020af180d0aa
-
SHA1
eb40d8dd7c7a4915c20313e7ebd7abd1bbb5711d
-
SHA256
130d22c798edc9a7aa99cd3a3d300486914c4b10f6aa3d018d0e3a9af22e7f46
-
SHA512
5f05fb184b46230d6f81572d3f724fc77617f19918a756a45e82fcdbdb722dab2838f91c36a8f9a04eb034b45a181a38064fb73a24d392c96f45ab3934985e21
-
SSDEEP
384:+eiWOr1O4L5uyNghxim/NFS3e3eXwwOl8Qx9DkBeW4LHRKZbdmL+ztf/L5mKE7vb:E1wh3TS3euXwwqlklQx840/LEb7D
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef6a3806fe854c4619c4020af180d0aa_JaffaCakes118
Files
-
ef6a3806fe854c4619c4020af180d0aa_JaffaCakes118.exe windows:4 windows x86 arch:x86
fabba3cf328658bb6a9da2d4492a25fa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
advapi32
RegCloseKey
shell32
ShellExecuteA
mfc42
ord1575
msvcrt
exit
msvcp60
??1_Winit@std@@QAE@XZ
Sections
.UPXVER1 Size: 17KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPXVER2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE