Behavioral task
behavioral1
Sample
3e8f7b1343c6ca6be70c7675662f5e43_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
3e8f7b1343c6ca6be70c7675662f5e43_JaffaCakes118
-
Size
111KB
-
MD5
3e8f7b1343c6ca6be70c7675662f5e43
-
SHA1
300d71d5fae32a59ce1eecd2eb9194afbbcf4e8a
-
SHA256
e7478b1a1eadff06561dfe0f730986440e1448866b0800921a7efae7344e3ac7
-
SHA512
67b51d8a130b7d44423109d30c61046b14217e862ca7140366c1550d56bc13d0d80ff12fadb3af17460b823664186f95e927e2c8135aa76a77cb0a621de8131b
-
SSDEEP
3072:68M4soGRhMQ7/QyTtH/QDGlG7li0UFFuGibV:68GRpYGIGlGwsG+V
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e8f7b1343c6ca6be70c7675662f5e43_JaffaCakes118
Files
-
3e8f7b1343c6ca6be70c7675662f5e43_JaffaCakes118.exe windows:4 windows x86 arch:x86
d5ae9ae0bf429e0381b867935ca84ba4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
libglib-2.0-0
g_assertion_message_expr
g_malloc
kernel32
AddAtomA
DuplicateHandle
ExitProcess
FindAtomA
GetAtomNameA
GetCurrentProcess
SetUnhandledExceptionFilter
msvcrt
_close
_dup2
_open
_read
_write
__getmainargs
__p___argc
__p___argv
__p__environ
__p__fmode
__set_app_type
__wgetmainargs
_assert
_cexit
_errno
_exit
_get_osfhandle
_iob
_onexit
_open_osfhandle
_setmode
_wchdir
_wspawnv
_wspawnvp
abort
atexit
atoi
free
malloc
memset
signal
strlen
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 180B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 104KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE