Behavioral task
behavioral1
Sample
fd1d56e4173440be07554000d6ca7db7_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd1d56e4173440be07554000d6ca7db7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fd1d56e4173440be07554000d6ca7db7_JaffaCakes118
-
Size
167KB
-
MD5
fd1d56e4173440be07554000d6ca7db7
-
SHA1
fc45174b1d103d42a0a43dc0599cec1ff51d4a05
-
SHA256
330f3a0a53716cb33c3ab219fde542d5975482e69b4824d0f819a5e7baafec79
-
SHA512
cf40262bc241e23652cbfb007d0f1ceac5dcb362b960e2386c1f2ac37050027e4b6130a859312331c5c3302c8e07fc1bfe41d19f474a33e6179c1529b2599a4d
-
SSDEEP
3072:2GbUu/BrFQW4Sjn0/cws376G+1kc50qIUBClJ5jdS14+FKGNp7yqI9PZ:2iySj0/W376Gakc51IUBuj814+F3NpVO
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd1d56e4173440be07554000d6ca7db7_JaffaCakes118
Files
-
fd1d56e4173440be07554000d6ca7db7_JaffaCakes118.exe windows:5 windows x86 arch:x86
8f3be410e562b9de8ad5fc60d9c08545
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_except_handler3
exit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
_cexit
_XcptFilter
_exit
_c_exit
setlocale
wcslen
qsort
strchr
_ftol
wcscoll
_wcsicoll
strcoll
_stricoll
atoi
_strnicmp
_iob
fprintf
advapi32
IsTextUnicode
kernel32
WideCharToMultiByte
GetTempPathA
GetTempFileNameA
GetDiskFreeSpaceA
WriteFile
CloseHandle
ResetEvent
ReadFile
GetOverlappedResult
GlobalMemoryStatusEx
GetSystemInfo
GetCPInfo
WaitForSingleObject
GetStdHandle
CreateFileA
GetFileType
GetFileSize
GetConsoleMode
CreateEventA
MultiByteToWideChar
GetProcessHeap
HeapAlloc
HeapFree
GetLastError
GetModuleHandleA
FormatMessageA
VirtualAlloc
ntdll
RtlMultiByteToUnicodeN
RtlUnicodeToOemN
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE