Behavioral task
behavioral1
Sample
fe70799bc7f6d19c36482ef4b1829c62_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
fe70799bc7f6d19c36482ef4b1829c62_JaffaCakes118
-
Size
160KB
-
MD5
fe70799bc7f6d19c36482ef4b1829c62
-
SHA1
c838a22ded8c7f3f91c66c2b432e68747c29f0a8
-
SHA256
02498d2d40596acd4f1acb3436ab368a19b0374702bad446155d5c3767b3f6fa
-
SHA512
a8190f091f90ee7b7322e9e5a992fcbfee500681c9e91e703c67387641876099d11f81ac3e06d00eb1f06b75818c73233a9b9aa15a64c3398f52714400c2973e
-
SSDEEP
3072:1MjwHUq0l38Kc3s86dWKDvzFYkzGptfenySrcr8PmpnNsSHUcRSwD/gR/e7qZZTL:WMv0tBICvKtg8nqS0+ViWqZZwO
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fe70799bc7f6d19c36482ef4b1829c62_JaffaCakes118
Files
-
fe70799bc7f6d19c36482ef4b1829c62_JaffaCakes118.exe windows:4 windows x86 arch:x86
69952d4a8e09e56e4e07259da1041691
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
setupapi
SetupDiGetDeviceInstanceIdA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiCallClassInstaller
kernel32
CreateFileA
Sleep
GetVersionExA
ReadFile
SetFileAttributesA
CloseHandle
LoadLibraryA
GetProcAddress
GetStringTypeW
GetCurrentProcess
GetLastError
SetCurrentDirectoryA
GetFileType
GetStdHandle
SetHandleCount
GetOEMCP
GetACP
GetCPInfo
GetEnvironmentStringsW
MultiByteToWideChar
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
FindFirstFileA
DeleteFileA
FindNextFileA
FindClose
RemoveDirectoryA
GetCurrentDirectoryA
OpenFile
GetWindowsDirectoryA
WinExec
GetCommandLineA
RtlUnwind
GetStringTypeA
WriteFile
GetEnvironmentStrings
LCMapStringW
TerminateProcess
ExitProcess
GetVersion
GetStartupInfoA
HeapCreate
HeapDestroy
GetModuleHandleA
HeapFree
LCMapStringA
WideCharToMultiByte
HeapAlloc
user32
DestroyWindow
SetWindowTextA
TranslateMessage
IsDialogMessageA
DispatchMessageA
GetDesktopWindow
GetWindowRect
SetWindowPos
wsprintfA
LoadCursorA
SetCursor
PostQuitMessage
SetDlgItemTextA
LoadStringA
MessageBoxA
PostMessageA
CreateDialogParamA
ShowWindow
GetMessageA
advapi32
OpenSCManagerA
DeleteService
RegSetKeySecurity
RegDeleteKeyA
InitializeAcl
AddAccessAllowedAce
IsValidSecurityDescriptor
GetTokenInformation
GetLengthSid
RegQueryValueExA
OpenServiceA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CloseServiceHandle
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegEnumValueA
OpenProcessToken
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE