Behavioral task
behavioral1
Sample
0e219ef693e19e9071176b3c6d19799e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0e219ef693e19e9071176b3c6d19799e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0e219ef693e19e9071176b3c6d19799e_JaffaCakes118
-
Size
23KB
-
MD5
0e219ef693e19e9071176b3c6d19799e
-
SHA1
8518e6cc23ad562c35c38e679009967936f8cce6
-
SHA256
e07ecd9d360a3d043121fac13cdb0d955e465b569c3a6f668d0335c852c3340c
-
SHA512
19aa1a1070054aa38cccff8442ad0784362939a52159e7406826d603cdb3d1369124982aff80315b7667c5a72c6b2d5f20aa358efcb1ade51a2c8ec657935910
-
SSDEEP
192:eRGIyiiV3PBlN74/0BqUu6VBmlBrU+5jspIfDJ30TMI:42dHNk2VYRU+6CDJkT3
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e219ef693e19e9071176b3c6d19799e_JaffaCakes118
Files
-
0e219ef693e19e9071176b3c6d19799e_JaffaCakes118.exe windows:4 windows x86 arch:x86
4f7ee12708e03bc5a90e08e36c4d4f79
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
ExitThread
SetEvent
GetTickCount
TerminateThread
WaitForSingleObject
CreateThread
CreateEventA
ReadFile
GetShortPathNameA
GetFileSize
_llseek
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
GetStartupInfoA
lstrcpyA
lstrcatA
GetEnvironmentVariableA
GetLastError
CreateFileA
WriteFile
CloseHandle
LoadLibraryA
GetProcAddress
OpenProcess
Sleep
GetModuleFileNameA
VirtualAlloc
VirtualFree
GetWindowsDirectoryA
GetSystemDirectoryA
FindFirstFileA
DeleteFileA
advapi32
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
RegOpenKeyExA
RegCloseKey
RegSetValueExA
CryptCreateHash
CryptAcquireContextA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyA
RegQueryValueExA
CryptHashData
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??3@YAXPAX@Z
strcat
sprintf
memset
_except_handler3
_local_unwind2
memcmp
strncpy
strlen
strcmp
strstr
strcpy
__CxxFrameHandler
toupper
tolower
__dllonexit
_onexit
shell32
ShellExecuteA
Sections
UPX0 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE