Behavioral task
behavioral1
Sample
facbf7f7fb79a5170b4639f8e0669604_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
facbf7f7fb79a5170b4639f8e0669604_JaffaCakes118
-
Size
164KB
-
MD5
facbf7f7fb79a5170b4639f8e0669604
-
SHA1
f10ee2a57f797e2ae4d7deea837eef78cf3c3ac1
-
SHA256
bc030d6202a3a1827b6910b96f9b4310836b890b6c0adb62eabebb8351c37a4e
-
SHA512
2cf885a6a3385e418b1008f50acd7b57e8b49099bd89ced7fc039292e96c20f89afbf4ef3eea2dbabcf614331199441ea6c57eda784c7327674b9411a8c0c6ff
-
SSDEEP
3072:Vi9ykB6ocvVrWb+w8GHvPMwG6J+Ux9pW2J0qL95DvzRK6:Vi9P4FBdGHv/JRxm2Jptvt
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource facbf7f7fb79a5170b4639f8e0669604_JaffaCakes118
Files
-
facbf7f7fb79a5170b4639f8e0669604_JaffaCakes118.exe windows:4 windows x86 arch:x86
be8913c6bdde3633d49d38948ee5f9a4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
GetVersionExA
CloseHandle
DeviceIoControl
GetSystemDirectoryA
TerminateProcess
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
ExitProcess
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
InitializeCriticalSection
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapAlloc
CreateFileA
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
SetFilePointer
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
FlushFileBuffers
SetStdHandle
advapi32
RegCloseKey
RegSetValueExA
ControlService
OpenServiceA
DeleteService
OpenSCManagerA
CloseServiceHandle
CreateServiceA
RegDeleteKeyA
RegCreateKeyExA
StartServiceA
Sections
.text Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE