Behavioral task
behavioral1
Sample
JaffaCakes118_0badb3be02f5f5a5c8e7fd64e118b618.exe
Resource
win7-20241023-en
General
-
Target
JaffaCakes118_0badb3be02f5f5a5c8e7fd64e118b618
-
Size
268KB
-
MD5
0badb3be02f5f5a5c8e7fd64e118b618
-
SHA1
2b0a64de9002f70feb48fa2a53fbecea278e7074
-
SHA256
e952c80f208f72542f41469affb7e241d905af5762a525643e2795737e5831b8
-
SHA512
48b504d4bf9c0cac611fc541ffda079c9641d2737433685604e2f3bed617746f757b52fa078376de48f8a5cf2883b385d3b2b9350bbd5a36d35c68c2e5e3e58d
-
SSDEEP
6144:o5q4MjTknKcjwzfxOZ9TdIEHFJW4CBEcdCfY1xaiqfIpvN20VEbVDy:IATkKbbxI9CEHFJzCCsCfYWivpvN20T
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_0badb3be02f5f5a5c8e7fd64e118b618
Files
-
JaffaCakes118_0badb3be02f5f5a5c8e7fd64e118b618.exe windows:4 windows x86 arch:x86
3039a04ea8ae6568d1f1f38e4ea28e48
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CertOIDToAlgId
CryptMsgOpenToDecode
CertDuplicateCertificateContext
CryptMsgGetParam
CertEnumCertificatesInStore
CertDuplicateStore
CryptMsgUpdate
CertGetNameStringA
CertCloseStore
CertCompareCertificateName
CertFindCertificateInStore
CertFreeCertificateContext
CertOpenStore
CryptDecodeObject
CryptMsgClose
wintrust
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
kernel32
GetLastError
GetModuleHandleA
GetModuleFileNameW
MoveFileW
MoveFileA
GetModuleFileNameA
MultiByteToWideChar
WaitForSingleObject
CreateSemaphoreA
SetEvent
CreateEventA
GetSystemTime
FreeLibrary
InitializeCriticalSection
LoadLibraryA
GetExitCodeThread
WaitForMultipleObjects
GetVersionExA
GetCurrentThreadId
LoadResource
Sleep
GetSystemInfo
RaiseException
ExitProcess
GetCurrentProcess
HeapCreate
IsBadWritePtr
TlsAlloc
GetStartupInfoA
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetACP
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
lstrcmpA
GetProcAddress
user32
CharUpperA
advapi32
RegSetValueExA
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
CryptGetHashParam
ole32
StringFromCLSID
scecli
SceStartTransaction
SceRegisterRegValues
SceAddToNameList
DllUnregisterServer
SceDcPromoCreateGPOsInSysvolEx
SceGetServerProductType
kbdkaz
KbdLayerDescriptor
Sections
UPX0 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.kREZn Size: 4KB - Virtual size: 415KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 91KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ocUcy Size: 512B - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.XtjX Size: 2KB - Virtual size: 285KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 131KB - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xQ Size: 5KB - Virtual size: 793KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ