Behavioral task
behavioral1
Sample
f746430b531e636a1c403f0d0724343a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f746430b531e636a1c403f0d0724343a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f746430b531e636a1c403f0d0724343a_JaffaCakes118
-
Size
60KB
-
MD5
f746430b531e636a1c403f0d0724343a
-
SHA1
a15c3f7127b4dad612ea7c98df836f69cd392db6
-
SHA256
d1659558b3083521cf5aaa0013c11b978fc9321253d164d06f810ed0710f7f84
-
SHA512
c02f2d349aa086dba7e9fc1e49eae6486cd030f319fef96903fee02d7729b6f22fbe3a0888118b1ab5d035d827e391d2fe2959f58fe7a7da0fbf4d5c2507558f
-
SSDEEP
768:pcTTIS1thTzm515fyHTFyowvh2AsM4TKkwubTM3kcCGSWeZyQMi2jXHU9:pcQS1nXTwzcpTKCEeZyX9rHU9
Malware Config
Signatures
-
Detects LgoogLoader payload 1 IoCs
Processes:
resource yara_rule sample family_lgoogloader -
Lgoogloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f746430b531e636a1c403f0d0724343a_JaffaCakes118
Files
-
f746430b531e636a1c403f0d0724343a_JaffaCakes118.exe windows:6 windows x86 arch:x86
9c9e958b00cb15e9e922c105f3945e5d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
SetFilePointer
WriteFile
FlushFileBuffers
CloseHandle
MoveFileExW
HeapFree
DeleteFileW
CreateProcessW
GetThreadContext
VirtualQueryEx
WriteProcessMemory
ReadProcessMemory
VirtualAllocEx
SetThreadContext
GetTempPathW
GetProcAddress
GetModuleHandleW
GetSystemDirectoryA
LoadLibraryA
GetFileSize
ReadFile
GetModuleHandleA
VirtualQuery
CreateDirectoryW
GetLongPathNameW
GetSystemTimeAsFileTime
lstrcatA
SetFileInformationByHandle
GetLastError
lstrcpyA
DeviceIoControl
MultiByteToWideChar
Sleep
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
GetProcessHeap
ResumeThread
HeapAlloc
user32
EnumDisplayDevicesA
wsprintfW
advapi32
RegQueryValueExA
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegEnumKeyW
ole32
CoCreateGuid
shlwapi
StrStrIW
StrNCatA
StrStrA
PathAppendA
PathAppendW
StrCatW
PathFileExistsW
StrStrIA
wininet
HttpAddRequestHeadersW
InternetConnectW
HttpSendRequestW
HttpQueryInfoW
HttpOpenRequestW
InternetSetOptionW
InternetReadFile
InternetCloseHandle
InternetCrackUrlW
InternetOpenW
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 504B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ