Behavioral task
behavioral1
Sample
JaffaCakes118_3637201eb61fc6170bb1e7958324dbc8.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_3637201eb61fc6170bb1e7958324dbc8
-
Size
259KB
-
MD5
3637201eb61fc6170bb1e7958324dbc8
-
SHA1
7c218e4823e558b6f77559bc1deef22f9e5e781c
-
SHA256
d70ce9c15ce4160bb8f01f1c73429846dc2ecbd2c262c302d4778b3e40337cec
-
SHA512
9e025bf451e7b1d4c3397a95174ac0d0c45e56f67b0cbbc1da2e5bab4d6a6779d98da26d23c6e871adfab3c057e21984cb05abac27992ae5f39539ea1441ad28
-
SSDEEP
6144:mTWe9o2bxVyFWkZzJxtejEfWZDkThADnmJRrtZB59:AXoImYuzheQWZAZ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_3637201eb61fc6170bb1e7958324dbc8
Files
-
JaffaCakes118_3637201eb61fc6170bb1e7958324dbc8.exe windows:4 windows x86 arch:x86
0fee85a1ecfb1030eb55b9e28b61941d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetLastError
GetTickCount
GetCurrentProcess
MultiByteToWideChar
GetSystemDirectoryW
GetVersionExA
GetProcessHeap
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
HeapCreate
ExitProcess
GetModuleFileNameA
GetEnvironmentStringsW
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
GetProcAddress
user32
GetSystemMetrics
LoadMenuIndirectA
GetDlgItemTextA
TrackPopupMenu
RegisterClassW
GetKeyboardType
SetCursor
IsMenu
RegisterWindowMessageA
InvalidateRect
SendDlgItemMessageW
CharLowerW
wsprintfA
GetDlgItemInt
WinHelpW
MessageBoxW
DialogBoxParamW
LoadBitmapW
GetSubMenu
DialogBoxIndirectParamW
GetMenuItemInfoA
GetIconInfo
ShowCursor
wvsprintfW
EmptyClipboard
InvalidateRgn
CheckMenuItem
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
mssip32
CryptSIPGetSignedDataMsg
CryptSIPGetRegWorkingFlags
gdi32
DeleteObject
CreateICA
CreateDIBPatternBrush
GetEnhMetaFileW
GetEnhMetaFileA
SetMetaFileBitsEx
CreateScalableFontResourceA
CreateFontW
CreatePen
CreateCompatibleDC
GdiGetBatchLimit
AddFontResourceA
CreateRectRgn
CreatePatternBrush
CreateDIBPatternBrushPt
filemgmt
DllGetClassObject
DllCanUnloadNow
DllRegisterServer
CacheSettingsDlg
Sections
UPX1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.c Size: 5KB - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 75KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.RvaZz Size: 5KB - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 138KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.C Size: 3KB - Virtual size: 559KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.WurWBH Size: 3KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ