Behavioral task
behavioral1
Sample
29ec27118184ef68e7405e20661053b8_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
29ec27118184ef68e7405e20661053b8_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
29ec27118184ef68e7405e20661053b8_JaffaCakes118
-
Size
23KB
-
MD5
29ec27118184ef68e7405e20661053b8
-
SHA1
6a543983a65b3850f3bd1f71f962570a40dd4f94
-
SHA256
02cb842ffec598f20c678ad11ee7449a7f7076455f835c8ac0a5fc1b9db02405
-
SHA512
1e49d63ded43f35190ce60a08307ee566d7cf1d37770a519315df74f098234b73b17b8b0a25c20661a9aee7961f5dfa7a094bc46824f2d3859570a39eb54aded
-
SSDEEP
192:MFrADl1K4yxfqYYeU3aupyqcGrpB+QjncIn/T30TBB:MEK4yFhuCyf+7y/TkT/
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29ec27118184ef68e7405e20661053b8_JaffaCakes118
Files
-
29ec27118184ef68e7405e20661053b8_JaffaCakes118.exe windows:4 windows x86 arch:x86
f1438212155f3e561b14c0bd55ddeae5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitThread
SetEvent
GetTickCount
TerminateThread
WaitForSingleObject
CreateThread
CreateEventA
ReadFile
TerminateProcess
GetFileSize
_llseek
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
GetStartupInfoA
GetShortPathNameA
lstrcpyA
lstrcatA
GetEnvironmentVariableA
GetLastError
CreateFileA
WriteFile
CloseHandle
LoadLibraryA
GetProcAddress
Sleep
OpenProcess
GetModuleFileNameA
VirtualFree
GetWindowsDirectoryA
GetSystemDirectoryA
FindFirstFileA
DeleteFileA
VirtualAlloc
advapi32
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
RegOpenKeyExA
RegCloseKey
RegSetValueExA
CryptCreateHash
CryptAcquireContextA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyA
RegQueryValueExA
CryptHashData
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??3@YAXPAX@Z
strcat
sprintf
_except_handler3
_local_unwind2
memset
memcmp
strncpy
strlen
strcmp
strstr
strcpy
__CxxFrameHandler
toupper
tolower
__dllonexit
_onexit
shell32
ShellExecuteA
Sections
UPX0 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE