Behavioral task
behavioral1
Sample
54fb7aaef14851a1d724c2e52f0fe4d5_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
54fb7aaef14851a1d724c2e52f0fe4d5_JaffaCakes118
-
Size
252KB
-
MD5
54fb7aaef14851a1d724c2e52f0fe4d5
-
SHA1
816e1b788924962644e70e4ea10063cf37ec5a56
-
SHA256
bff3d69dc7051a884f27722d251eb6e691109e19299504f96e760ecb297b5ef5
-
SHA512
eb4faa8425ff9e49b5b803093e2312c1353e8126c630252a98323bb88d316ab078427e5ce4a99bf62f4279144c4c8aabf3edcc12bd9aa253a114c476c4c910b9
-
SSDEEP
6144:QwA/7zn+RCHHCqbRXUEdada8Iv8nroSjx:Yzn+wHHCqFE/nIv6oSd
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 54fb7aaef14851a1d724c2e52f0fe4d5_JaffaCakes118
Files
-
54fb7aaef14851a1d724c2e52f0fe4d5_JaffaCakes118.exe windows:5 windows x86 arch:x86
5f1a90a707af8b7e7e9a2f594223eb01
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
MoveFileA
DeleteFileA
GetModuleFileNameA
GetCommandLineA
Sleep
GetLocalTime
MultiByteToWideChar
GetTickCount
GetCurrentThreadId
lstrcmpiA
lstrlenW
WideCharToMultiByte
RaiseException
FlushInstructionCache
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpA
MulDiv
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
DeleteCriticalSection
SetEvent
InterlockedDecrement
InitializeCriticalSection
CreateThread
ReadFile
SetEndOfFile
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
SetFilePointer
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
HeapSize
GetStdHandle
WriteFile
HeapCreate
ExitProcess
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualProtect
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
GetTempPathA
CreateDirectoryA
RemoveDirectoryA
CreateMutexA
ExpandEnvironmentStringsA
lstrcpyA
lstrcatA
lstrlenA
GetFileAttributesExA
GetCurrentProcess
GetModuleHandleA
DuplicateHandle
GetExitCodeProcess
GetProcAddress
CreateRemoteThread
GetLastError
WaitForSingleObject
CloseHandle
SetLastError
UnhandledExceptionFilter
TerminateProcess
ResumeThread
ExitThread
RtlUnwind
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
advapi32
RegDeleteValueA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
gdi32
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
GetStockObject
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetObjectA
GetDeviceCaps
netapi32
Netbios
ole32
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
CoInitializeEx
OleLockRunning
CoUninitialize
CoInitialize
oleaut32
VariantClear
VariantInit
SysFreeString
DispCallFunc
LoadRegTypeLi
LoadTypeLi
SysStringLen
SysAllocString
SysAllocStringLen
OleCreateFontIndirect
psapi
GetModuleFileNameExA
EnumProcesses
shell32
ShellExecuteA
shlwapi
PathFindFileNameA
PathGetArgsA
StrStrIW
StrToIntA
UrlUnescapeA
PathIsDirectoryA
PathRemoveBlanksA
PathRemoveFileSpecA
PathFileExistsA
user32
SetWindowPos
SetWindowLongA
MessageBoxA
wsprintfA
LoadBitmapA
FillRect
IsWindowVisible
ClientToScreen
PeekMessageA
TranslateMessage
SetLayeredWindowAttributes
DispatchMessageA
FindWindowA
MoveWindow
IsWindow
GetWindowRect
GetFocus
WindowFromPoint
GetForegroundWindow
GetCursorPos
AttachThreadInput
GetWindowThreadProcessId
FindWindowExA
DefWindowProcA
BringWindowToTop
InvalidateRgn
PostThreadMessageA
DestroyWindow
GetDlgItem
UnregisterClassA
InvalidateRect
SetCapture
ReleaseCapture
ScreenToClient
CreateAcceleratorTableA
GetDC
ReleaseDC
GetDesktopWindow
CharNextA
GetParent
GetClassNameA
RedrawWindow
IsChild
SetFocus
GetWindow
GetSysColor
DestroyAcceleratorTable
SendMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
RegisterWindowMessageA
GetClassInfoExA
LoadCursorA
RegisterClassExA
EndPaint
BeginPaint
GetClientRect
GetWindowLongA
CallWindowProcA
CreateWindowExA
ShowWindow
ws2_32
socket
recv
send
closesocket
__WSAFDIsSet
select
connect
ioctlsocket
htons
gethostbyname
WSAStartup
Sections
UPX0 Size: 248KB - Virtual size: 248KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE