Behavioral task
behavioral1
Sample
1413d3fd69ac3899502c3c69b2d713bc_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1413d3fd69ac3899502c3c69b2d713bc_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
1413d3fd69ac3899502c3c69b2d713bc_JaffaCakes118
-
Size
250KB
-
MD5
1413d3fd69ac3899502c3c69b2d713bc
-
SHA1
de4b9da2434f11f9aa662141e3c70032af5f959d
-
SHA256
45134c9e8e3fcd5c3ce5efac3d7620c3de05ab232b8869e2e3d30f8ed17411f6
-
SHA512
9e91284223a6a6cc48c7915f41cf0e9b872802dfded584ae8631235c2b4888aab157835fe14884a2fb62c9be19ce0ce96c5f2fa289a64998ac2503458d7d2b16
-
SSDEEP
6144:JZ/4UHB0CnKk/T7J6bdULh3VvKsO5GTHYjlzIS:BKk/TCdULxViZ5GrYjlzx
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1413d3fd69ac3899502c3c69b2d713bc_JaffaCakes118
Files
-
1413d3fd69ac3899502c3c69b2d713bc_JaffaCakes118.exe windows:4 windows x86 arch:x86
ee1f3aa89716293e7f70a15ad6bb3168
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetLastError
GetTickCount
GetCurrentProcess
MultiByteToWideChar
GetSystemDirectoryW
GetVersionExA
GetProcessHeap
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
HeapCreate
ExitProcess
GetModuleFileNameA
GetEnvironmentStringsW
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
GetModuleHandleW
GetProcAddress
user32
GetSystemMetrics
MessageBoxIndirectA
GetMenuItemRect
CreateDialogParamW
CharUpperA
PostQuitMessage
CharNextA
PostMessageA
GetTopWindow
GetIconInfo
EnumWindows
FindWindowW
DialogBoxParamW
SetCursor
SetDlgItemTextW
LoadImageA
CreateAcceleratorTableW
GetMenuStringA
DialogBoxIndirectParamW
wsprintfW
GetSubMenu
RegisterClassW
CopyIcon
SetActiveWindow
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
usp10
ScriptGetProperties
ScriptFreeCache
ScriptItemize
ScriptTextOut
ScriptString_pcOutChars
ScriptIsComplex
ScriptStringGetLogicalWidths
ScriptApplyDigitSubstitution
UspAllocCache
gdi32
RemoveFontResourceExW
CreateFontA
UpdateICMRegKeyA
CreatePolyPolygonRgn
RemoveFontResourceA
CreateScalableFontResourceW
CreateDIBPatternBrushPt
filemgmt
DllGetClassObject
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 1024B - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 79KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CODE Size: 512B - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 141KB - Virtual size: 237KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ