Behavioral task
behavioral1
Sample
fcd22cc3e72c3f4a55ea3198e8ad116d_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fcd22cc3e72c3f4a55ea3198e8ad116d_JaffaCakes118
-
Size
116KB
-
MD5
fcd22cc3e72c3f4a55ea3198e8ad116d
-
SHA1
400a10bc7d503546539ebb874013389fd61d9ec3
-
SHA256
1b4d23c13d4d66c7150b4fc4a5bb17c4219852c1fd6b2f33d8adb7caa9ba59ef
-
SHA512
b7f00369ea62f7e8b1397843e5026c5e4ef3fb040c6be0e7102ee2099e7c69acc0d0d6a86b7f740c41ef1c2a2ae6d500c11e3ad9119b2de823523129e3765c51
-
SSDEEP
3072:+1i/NU8LOMYcYYcmy5iYe6ssvdTVy0H/KZHi1cQR4TiOPQnZ:Ii/NTO5RsslwiXZCiOPo
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fcd22cc3e72c3f4a55ea3198e8ad116d_JaffaCakes118
Files
-
fcd22cc3e72c3f4a55ea3198e8ad116d_JaffaCakes118.exe windows:4 windows x86 arch:x86
a3df484e18e6947ceb4adab22a81104a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleW
GetShortPathNameW
GetEnvironmentVariableW
GetCurrentThread
SetThreadPriority
SetPriorityClass
GetCurrentProcess
lstrlenW
LocalAlloc
LocalFree
GetPrivateProfileStringW
WritePrivateProfileStringW
GetModuleFileNameW
CloseHandle
FreeLibrary
FindResourceW
LoadResource
LockResource
SizeofResource
lstrcpyW
FindFirstFileExW
SetFileAttributesW
DeleteFileW
FindNextFileW
FindClose
WriteFile
CreateFileW
LoadLibraryExW
GetStartupInfoW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PeekMessageW
TranslateMessage
DispatchMessageW
MessageBoxW
GetDesktopWindow
advapi32
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
FreeSid
SetFileSecurityW
RegSetKeySecurity
RegDeleteValueW
RegQueryValueExW
RegCreateKeyW
RegSetValueW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
shell32
SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW
SHChangeNotify
ole32
CoUninitialize
CoCreateInstance
CoInitialize
msvcp60
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
??1bad_alloc@std@@UAE@XZ
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@PBDH@Z
?fail@ios_base@std@@QBE_NXZ
?eof@ios_base@std@@QBE_NXZ
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
?close@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@PBDH@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?write@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@PBGH@Z
?close@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXXZ
??_D?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXXZ
??_D?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHPBG@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGPAG0@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGPAGG@Z
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ
iphlpapi
GetAdaptersInfo
msvcrt
_wtoi
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
swprintf
wcscat
_controlfp
_except_handler3
__set_app_type
__p__fmode
_snwprintf
wcsncpy
free
memcpy
malloc
__CxxFrameHandler
memset
??2@YAPAXI@Z
wcslen
_wcslwr
_wcsicmp
wcstombs
strlen
__p__commode
Sections
.text Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE