Behavioral task
behavioral1
Sample
3c779ac13d7a9f3296334b6dd3231d8a_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
3c779ac13d7a9f3296334b6dd3231d8a_JaffaCakes118
-
Size
305KB
-
MD5
3c779ac13d7a9f3296334b6dd3231d8a
-
SHA1
35177f4122af47944dc241a87a9d1e87135fc247
-
SHA256
d9e818d2fc8ac25dbb17e8e0d4f79df247ec87b8a4d96e42a5829b82165ef761
-
SHA512
67b587a129a06c0fbe1bcebec4247f9f49a7faa1c8a4f41f3a83a71574ff3438884ae496748766b11ca867ba36a3fefcad5fe0a0b3747eda048285f8c3c4070e
-
SSDEEP
6144:8Qhn1nUq+pUaIymtvuzvoYbVko36Ck9hLQtta2Ss14g:r+pLFAa936Ck9hUtgq
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c779ac13d7a9f3296334b6dd3231d8a_JaffaCakes118
Files
-
3c779ac13d7a9f3296334b6dd3231d8a_JaffaCakes118.exe windows:4 windows x86 arch:x86
0044c44edac3c43f16d73388f6eeec8f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempPathA
GetStartupInfoA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
TransactNamedPipe
GetCurrentThread
GetCurrentProcess
CreateEventA
MultiByteToWideChar
GetLastError
CopyFileA
GetModuleFileNameA
OpenProcess
GetModuleHandleA
CreateThread
TerminateThread
FreeConsole
AllocConsole
GetStdHandle
WriteFile
CreateNamedPipeA
WaitNamedPipeA
CreateFileA
TerminateProcess
CloseHandle
ReadFile
GlobalMemoryStatus
GetVersionExA
GetComputerNameA
ExpandEnvironmentStringsA
CreateProcessA
GetSystemDirectoryA
ExitProcess
DeleteFileA
LoadLibraryA
GetProcAddress
FreeLibrary
Sleep
GetTickCount
advapi32
StartServiceA
RegQueryInfoKeyA
RegEnumKeyExA
DeleteService
ControlService
EnumServicesStatusA
RegQueryValueExA
OpenThreadToken
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegCloseKey
OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
ChangeServiceConfig2A
RegCreateKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameA
RegOpenKeyExA
RegSetValueExA
RegDeleteValueA
dnsapi
DnsQuery_A
mpr
WNetAddConnection2W
WNetCancelConnection2A
WNetAddConnection2A
WNetCancelConnection2W
msvcp60
?_Xran@std@@YAXXZ
?_Xlen@std@@YAXXZ
msvcrt
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_iob
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
sprintf
isdigit
calloc
printf
perror
_errno
strerror
fflush
sscanf
wcstombs
mbstowcs
wcscpy
memchr
_except_handler3
fprintf
strcat
__CxxFrameHandler
toupper
fputc
wcscat
strtok
_ftol
rand
__p__commode
__p__fmode
ftell
malloc
free
exit
strncmp
atof
_memccpy
_stricmp
strchr
strncat
memcmp
system
atoi
strcpy
fgets
strcmp
memmove
memcpy
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
_vsnprintf
strlen
strncpy
fopen
fclose
fseek
fread
memset
strstr
??2@YAPAXI@Z
_purecall
??3@YAXPAX@Z
_EH_prolog
fwrite
__set_app_type
_controlfp
srand
_strdup
netapi32
NetUseDel
NetApiBufferFree
NetShareEnum
NetUserEnum
NetScheduleJobAdd
NetRemoteTOD
NetUseAdd
odbc32
psapi
EnumProcesses
GetModuleBaseNameA
EnumProcessModules
shell32
ShellExecuteA
user32
ExitWindowsEx
wsprintfA
ws2_32
WSASocketA
WSAIoctl
Sections
UPX0 Size: 300KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE