Behavioral task
behavioral1
Sample
fd0ee3982db81209cf782f774f5624ca_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd0ee3982db81209cf782f774f5624ca_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fd0ee3982db81209cf782f774f5624ca_JaffaCakes118
-
Size
602KB
-
MD5
fd0ee3982db81209cf782f774f5624ca
-
SHA1
0757760a36dbdba1b425817ae3e780c2d9047af9
-
SHA256
c7f3066d35a1628e49880215141fd819b2c31502aeb50f4cdfdc0fd4b334b783
-
SHA512
9fe5827be67883bd839948b411f0b423660fafed6fcfa940157e248486200852b97e452d8b9f80c150acbda1f9fc8c1482c35451075d1aa06d9348b5ac667c03
-
SSDEEP
12288:MIpG5lELO0NjARU6poldPtkDjqQfujEljrqdieVxgGYHelvD00qnLxb:4fELx8a9tknqQfGArqdNgGRho5nNb
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
fd0ee3982db81209cf782f774f5624ca_JaffaCakes118.exe windows:4 windows x86 arch:x86
4873abd4c4a13468dec4f1b271ccbbce
Code Sign
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/01/1997, 07:00Not After31/12/2020, 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporationc1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/01/1997, 07:00Not After31/12/2020, 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation61:47:52:ba:00:00:00:00:00:04Certificate
IssuerCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/09/2006, 01:53Not After16/09/2011, 02:03SubjectCN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
61:47:52:ba:00:00:00:00:00:04Certificate
IssuerCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/09/2006, 01:53Not After16/09/2011, 02:03SubjectCN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before16/09/2006, 01:04Not After15/09/2019, 07:00SubjectCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
61:02:30:7e:00:00:00:00:00:06Certificate
IssuerCN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before10/03/2008, 21:57Not After10/06/2009, 22:07SubjectCN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before11/10/2005, 21:55Not After26/04/2010, 07:00SubjectCN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
20:02:e6:73:07:47:33:c7:76:6f:44:f2:e6:de:54:59:7f:17:26:adSigner
Actual PE Digest20:02:e6:73:07:47:33:c7:76:6f:44:f2:e6:de:54:59:7f:17:26:adDigest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
advapi32
CreateServiceA
Exports
Exports
z� �$������t�LRm����!��S��_�{:v�fl)]-?Hbe�hAjk]Ճ���J���8��v���R-�J����pU���g�-'�쫕C�]�AJ���1Z�?;Kw��5ڹ��P�xB=�������x��0���.Ŝ�1��^����4�=#H��<��N�l�U�`�|n����L¡0��;&��&!y7�S�R�F'>i���U-���I3�]���UVH|||�C/��\��l➶����������I�ףZQ���'���:�~(J�H|l;����X�h�R<N'&��Y)h|�E-,)��Ň+ǂ�ڪs�vP�`���o��p��7Tf�d�/�XI.B����@``9X�����_\��A�CT}Ю�B쬐T3����l������N<�)F9+g]����4���_t}G>��"�窦h)C���E�_^������՚{Y�lj��m��7`�ѽ�@&N4zm&P����|�ţ~Z�eD�q��0�2�#!�+��U��_y�S��McB��������Ez�`�k3�%������=��K�z�l����E�!�~��i�Ř�(__�H��$��W9�aIT�z�0�Ϊ� ��Pe�5+/�i �O)��vSc!���k`ۜh�X��a�L�9ё͖�J��3�����"��^S+^�M"/q�&����4��NnIEJ�i<�d^�/]�Av^�Ʃ�4�»��Z���� 5����d�[�����[)���w��G����Tz����~%ħ+�m|��B��*(�h��W�Ɍ0v���R=��Pe��0�n!�f�O��g�z�0����x�?�瓼H����D']�J���ez�`y�Ɗ�2�S�FH����5�Kz�����g�e�x)���p�lQ�9���ۇ���r����8gQ��c��/�!ޅn��Co���h��y�~C��-�3���j�,:$kJwhub|6��# ��0����7��Nn�����V����q! �jM ��{�7o5V�NA\���k�d�VY#�R�R���4��q�T��M��5�O���t�yZ����쬁S������p��S쬟P}��S�*�F � ��rf���S��i��b���E%��W����d.g��� ���L>aq���*0A&�}!��<��4gCVm��YJ3�ewyQUZ ��+�Vi�@�L'�oj̞��Z��)���<� �\���7������=�=�p��e���R��������F- ��+͍4��}��%,I���ZO��"��:�q�:� P��ygG}��oG���o�����kĄ HLN����c�g���ykS<�,mJ�P���p��Ce�@�~H�d��0�n��=�-rJ=֨*�<�L8�Q��Dz�Wvj൦l����=pky6�������u�������Ճ��b!�p����tAf�}�Q\<�B�J]�����E�34U�YN2g��T;.���ɭ����jkzL��b��wn2y��$I�J�u�]홫�(J8��mC�$}ɲ������Dӑ��s*�r m�GvRow�t����)���x��@����%r������£k��2]�4�����⸏�d���^����ދ>��TY2)����,�{Y&� �{��D�C -=(����G�&k�3�C��D���/jrӆ���}� ?��' m��?ۻ��9�������1�+���"�u֕�����W��!��CSl1h��1u��:�+��ص���_̃��%��P������������5`�q�qzwf�Q��ps��%,���kچpr �c:�Y�*���y��W����b�� _A�m�St"eZ����!Ow_䧉$��8A:��(�� j� ��H����[<cM^���P��4yG�O�I�e���D����M���V�QrV��m���L�^D ��Jǣ����=�=�/�|%��3-J<�"|>�[��(���aW��Iq,3�W�u[}��f~�ٗ�G�4��*�p�˥Y��Z]7<K����N����Ң��*�u[� �M�#��[�N�4<���g���om�����b&�I��L],�-��ݕ^T|�~��� �4��9�[;��[�g.m;�; r�����2q>��v1�u�����K1��дJ'���۬����0?��H+���}칏J�e���_΄���?� BUIR�D�@ ���h6l5EV�%�eLJd�����h`�W�;T'c_�:9�.{q�8#�!R�e3$�I���*��s)�����RdDM�O�u���`8�Q���+�ZD�<:�k�;��U�\�s#�z?MU��lj��nk�I�c�͡�ze�>��(�l�3 ��B���� jLw^�&/�O���X�V��]��P����收�'��q�4��7ȑ͘n��R.3�� Q��b+&kq�qw9�t��H�@�h�^��-��|� k7�G�˞������#h���7�,�ћ�>���L ��� M�5@�+�v*�4s:�� ��J�����|�7��ȿ��Q��������/�+��� L����9/��7��P�v��Pֆ_���K��.���K��"{��?KD�fi�#�0Qu�LI���[R��~�����x��#��0ep z�4��Wa�ڻ�g�_,��4[őn�*��$���1��Ȧ�]������I3�+�ᗀ0�����7;-.U���@����S��|aS���1�>'% �׃9�(u�_�2�X��C8������m��N�xp�35��y��G��#�������|zf����{���,X�{�L3��4qA����P������c;�1���M��������PB��^�> H#2�����,.�`Q\:Z�OA����A;!�m6��>��\*).�hz��x=�5�,��~�uB�����US1/���m����ZI���O�zh���P��!��Ŷ���ʳ �^�&a���9"FQ�Y����f���d6��ā��`=ѩ�A��&=K��,�� 3w¿��YW Ȁ�5G<�:�������w!�>/�����x���2`<;�����g5ߚ��V^���*��
Sections
.text Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 237KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 590KB - Virtual size: 590KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ