Behavioral task
behavioral1
Sample
24d7a726d964be236956e199770205cc_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
24d7a726d964be236956e199770205cc_JaffaCakes118
-
Size
144KB
-
MD5
24d7a726d964be236956e199770205cc
-
SHA1
f95f38bf4d94b1e36da1641d5c7ff7e84ed41cd2
-
SHA256
accd298b2499cb176db8d15a801e16ad40671f189a1c492b7e75b088193cc531
-
SHA512
c99195af0c09af58e2f90c2ad1f69c62223ce5f8a6a943996b70a4d6267ce7939afbe2fd90f37a799d77de8295a290a3d6aafcd0af1e3a9e52daacf1ac69abea
-
SSDEEP
3072:YBs0nf0qIWyf6fzr/U7ZDYxhKDlYUqH05RF:YhnMqIWwKXc7yGG+x
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 24d7a726d964be236956e199770205cc_JaffaCakes118
Files
-
24d7a726d964be236956e199770205cc_JaffaCakes118.exe windows:4 windows x86 arch:x86
4b8f8f86c862d91eee678f50f87b1c16
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocaleInfoA
GetCPInfo
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
HeapSize
GetACP
SetFilePointer
IsBadCodePtr
IsBadReadPtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
VirtualQuery
GetSystemInfo
VirtualProtect
LoadLibraryA
GetOEMCP
SetEndOfFile
Sleep
ReadFile
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
SetUnhandledExceptionFilter
GetCommandLineA
GetStartupInfoA
CreateThread
CreateMutexA
GetTimeZoneInformation
GetLocalTime
SystemTimeToFileTime
GetSystemTime
WaitForSingleObject
ReleaseMutex
GlobalFree
GlobalAlloc
OpenMutexA
CloseHandle
GetModuleFileNameA
WriteFile
CreateFileA
GetVersionExA
GetLastError
Module32Next
Module32First
CreateToolhelp32Snapshot
GetCurrentProcess
Process32Next
TerminateProcess
GetExitCodeProcess
OpenProcess
Process32First
GetCurrentThread
RaiseException
GetSystemTimeAsFileTime
RtlUnwind
HeapFree
HeapAlloc
ExitProcess
GetProcAddress
GetModuleHandleA
GetCurrentProcessId
advapi32
StartServiceA
CloseServiceHandle
DeleteService
OpenThreadToken
RegCreateKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ChangeServiceConfigA
RegDeleteValueA
OpenSCManagerA
OpenServiceA
ControlService
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
QueryServiceStatus
dnsapi
DnsQuery_A
DnsRecordListFree
iphlpapi
GetBestInterface
GetFriendlyIfIndex
GetIpAddrTable
GetNetworkParams
psapi
EnumProcesses
GetModuleFileNameExA
GetModuleBaseNameA
user32
PostThreadMessageA
GetWindowTextA
PostMessageA
FindWindowExA
EnumChildWindows
SendMessageA
ScreenToClient
GetWindowRect
GetWindowLongA
GetDlgItem
EnumWindows
FindWindowA
wsprintfA
wininet
HttpQueryInfoA
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
ws2_32
Sections
UPX0 Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE