Behavioral task
behavioral1
Sample
JaffaCakes118_669d2d6e75c83e3092943f65007fdf80.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_669d2d6e75c83e3092943f65007fdf80
-
Size
282KB
-
MD5
669d2d6e75c83e3092943f65007fdf80
-
SHA1
1d1fa86dc200da1fef6210aa73c2cd5b840b2ee3
-
SHA256
7ba37ea842c27b8066b8fe9bc0c860bc7091d7d322b18a44432dce27759a1482
-
SHA512
f72abfc0cceabee9910f7447a2b5478b178a30d239f6a4350dc8b88659a276aa3cbdb90b3a3c026ea397e92366655b8058eac3fb407333edc1840612e2fb34d5
-
SSDEEP
6144:zZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF1M:VFTxWYMh5qoLb8LCy9E
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_669d2d6e75c83e3092943f65007fdf80
Files
-
JaffaCakes118_669d2d6e75c83e3092943f65007fdf80.exe windows:4 windows x86 arch:x86
913a4a367a3cc426f8f8ac8fe6743a43
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AllocateAndInitializeSid
EqualSid
FreeSid
GetTokenInformation
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
kernel32
FileTimeToSystemTime
FreeLibrary
GetCurrentProcess
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcessHeap
GetSystemDirectoryA
GetVersion
GetVersionExA
GetWindowsDirectoryA
InitializeCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
Sleep
lstrcmpiA
LoadLibraryW
GetProcAddress
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
wsock32
ioctlsocket
inet_addr
comdlg32
GetOpenFileNameW
user32
DestroyIcon
GetSystemMetrics
LoadIconA
PostMessageA
SetFocus
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SysAllocStringLen
SysFreeString
scecli
SceStartTransaction
SceGetDatabaseSetting
InitializeChangeNotify
SceRollbackTransaction
SceDcPromoCreateGPOsInSysvolEx
SceAddToNameStatusList
SceSetupUpdateSecurityFile
SceGetObjectChildren
SceIsSystemDatabase
SceEnforceSecurityPolicyPropagation
SceWriteSecurityProfileInfo
advpack
ExtractFiles
OpenINFEngine
Sections
UPX1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Y Size: 512B - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qvae Size: 4KB - Virtual size: 419KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.T Size: 2KB - Virtual size: 550KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 139KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tiFp Size: 512B - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aqJji Size: 3KB - Virtual size: 471KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ