Behavioral task
behavioral1
Sample
f5c125bbf81969a0c5871c77b1abc479_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
f5c125bbf81969a0c5871c77b1abc479_JaffaCakes118
-
Size
259KB
-
MD5
f5c125bbf81969a0c5871c77b1abc479
-
SHA1
d857147d14546b1786b3e47bab0acfcabc4a7a17
-
SHA256
513f1b53352be385dd499ecebb26283cefff1a89ab171c513d0b7c9479ce7678
-
SHA512
b5daf45e4cb6ab87bcbca857b2ead673c746cc5a8e73c193a06a1a206c919a1d004bf2a37402ab59f3bbfc2334e8e442bf7edff5b9e9690150b35691028313c8
-
SSDEEP
6144:cTWe9o2bxVyFWkZzJxtejEfWZDkThADnmJRrtZB59:qXoImYuzheQWZAZ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f5c125bbf81969a0c5871c77b1abc479_JaffaCakes118
Files
-
f5c125bbf81969a0c5871c77b1abc479_JaffaCakes118.exe windows:4 windows x86 arch:x86
0fee85a1ecfb1030eb55b9e28b61941d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetLastError
GetTickCount
GetCurrentProcess
MultiByteToWideChar
GetSystemDirectoryW
GetVersionExA
GetProcessHeap
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
HeapCreate
ExitProcess
GetModuleFileNameA
GetEnvironmentStringsW
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
GetProcAddress
user32
GetSystemMetrics
LoadMenuIndirectA
GetDlgItemTextA
TrackPopupMenu
RegisterClassW
GetKeyboardType
SetCursor
IsMenu
RegisterWindowMessageA
InvalidateRect
SendDlgItemMessageW
CharLowerW
wsprintfA
GetDlgItemInt
WinHelpW
MessageBoxW
DialogBoxParamW
LoadBitmapW
GetSubMenu
DialogBoxIndirectParamW
GetMenuItemInfoA
GetIconInfo
ShowCursor
wvsprintfW
EmptyClipboard
InvalidateRgn
CheckMenuItem
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
mssip32
CryptSIPGetSignedDataMsg
CryptSIPGetRegWorkingFlags
gdi32
DeleteObject
CreateICA
CreateDIBPatternBrush
GetEnhMetaFileW
GetEnhMetaFileA
SetMetaFileBitsEx
CreateScalableFontResourceA
CreateFontW
CreatePen
CreateCompatibleDC
GdiGetBatchLimit
AddFontResourceA
CreateRectRgn
CreatePatternBrush
CreateDIBPatternBrushPt
filemgmt
DllGetClassObject
DllCanUnloadNow
DllRegisterServer
CacheSettingsDlg
Sections
UPX1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.c Size: 5KB - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 75KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.RvaZz Size: 5KB - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 138KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.C Size: 3KB - Virtual size: 559KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.WurWBH Size: 3KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ