Behavioral task
behavioral1
Sample
01f276d89f36eea04bae4d0ac07dce2b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
01f276d89f36eea04bae4d0ac07dce2b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
01f276d89f36eea04bae4d0ac07dce2b_JaffaCakes118
-
Size
23KB
-
MD5
01f276d89f36eea04bae4d0ac07dce2b
-
SHA1
6803759c3bc8f9acba61b11e1e23867d8dd1a0ea
-
SHA256
f39294a257acab0ee24ebaed86664ccabb2a54e920de55c832b36746344321f3
-
SHA512
4d3bdea9ccd7f87adff39d7f64a88b0389e65e220cb2b0b4bc6051bee2da27e9efc918f6226636329891ed5ee9b2a62f39ee4eb36ec1a85c3f0843e29818cd52
-
SSDEEP
192:MsTmcwsbQ50biU6+jyyDcBrpB+QjncIn/T30TBB:MebQqj4Rf+7y/TkT/
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 01f276d89f36eea04bae4d0ac07dce2b_JaffaCakes118
Files
-
01f276d89f36eea04bae4d0ac07dce2b_JaffaCakes118.exe windows:4 windows x86 arch:x86
f1438212155f3e561b14c0bd55ddeae5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitThread
SetEvent
GetTickCount
TerminateThread
WaitForSingleObject
CreateThread
CreateEventA
ReadFile
TerminateProcess
GetFileSize
_llseek
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
GetStartupInfoA
GetShortPathNameA
lstrcpyA
lstrcatA
GetEnvironmentVariableA
GetLastError
CreateFileA
WriteFile
CloseHandle
LoadLibraryA
GetProcAddress
Sleep
OpenProcess
GetModuleFileNameA
VirtualFree
GetWindowsDirectoryA
GetSystemDirectoryA
FindFirstFileA
DeleteFileA
VirtualAlloc
advapi32
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
RegOpenKeyExA
RegCloseKey
RegSetValueExA
CryptCreateHash
CryptAcquireContextA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyA
RegQueryValueExA
CryptHashData
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??3@YAXPAX@Z
strcat
sprintf
_except_handler3
_local_unwind2
memset
memcmp
strncpy
strlen
strcmp
strstr
strcpy
__CxxFrameHandler
toupper
tolower
__dllonexit
_onexit
shell32
ShellExecuteA
Sections
UPX0 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE