Behavioral task
behavioral1
Sample
JaffaCakes118_af2145886f791c6f1b549cbdb4db137a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_af2145886f791c6f1b549cbdb4db137a.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_af2145886f791c6f1b549cbdb4db137a
-
Size
246KB
-
MD5
af2145886f791c6f1b549cbdb4db137a
-
SHA1
3fb24aecec708cd316530dc5088bc813d5116342
-
SHA256
f40e8bbf878b5ad7a5e9bc3483ff602f0c90f08cbc84f9bf2c7976827f7c9435
-
SHA512
a380cc656d32a272e1d656313374148b2cb85aaa30def467a3bbe74edb7d42cd7d990cdc2a066b57b6bc45904b7ad4a6c8cbfc0dd61eacb820904d3009616c65
-
SSDEEP
6144:QeEUq3/sSzA7pfXG7m9ln3T4Y9qd4yqUTJ7nTti:kM7p0mnn3kYYdeUTtpi
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_af2145886f791c6f1b549cbdb4db137a
Files
-
JaffaCakes118_af2145886f791c6f1b549cbdb4db137a.exe windows:4 windows x86 arch:x86
b58b33fee3515f8f9be18210cf425a28
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
GlobalAlloc
CreateEventW
OpenEventW
GetCurrentProcessId
CreateSemaphoreW
GetSystemTime
GetModuleFileNameW
GetProcessHeap
HeapCreate
lstrlenA
ExitProcess
GetShortPathNameA
GetModuleFileNameA
MultiByteToWideChar
CreateMutexW
FreeLibrary
LoadLibraryW
GetSystemInfo
GetVersionExA
ExpandEnvironmentStringsW
CreateDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemDirectoryW
LoadLibraryA
GetVolumeInformationW
LocalFree
WaitForMultipleObjects
OpenEventA
GetLastError
GetFileAttributesW
Sleep
InitializeCriticalSection
GetCurrentThread
GetTickCount
SetEvent
WaitForSingleObject
GetCurrentProcess
lstrcpynA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetStartupInfoA
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
GetEnvironmentStringsW
BeginUpdateResourceW
GetProcAddress
user32
CharPrevA
CharUpperA
advapi32
AccessCheck
RegSetValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsA
GetTraceLoggerHandle
GetTraceEnableFlags
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
ReportEventW
DeregisterEventSource
RegisterEventSourceW
DuplicateToken
RevertToSelf
ImpersonateLoggedOnUser
AdjustTokenPrivileges
GetNamedSecurityInfoW
LookupPrivilegeValueA
MapGenericMask
TraceMessage
OpenThreadToken
OpenProcessToken
rpcrt4
RpcServerRegisterIf
RpcServerListen
RpcMgmtStopServerListening
RpcImpersonateClient
RpcServerUnregisterIf
RpcRevertToSelf
RpcServerUseProtseqEpA
NdrServerCall2
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
inseng
DownloadFile
DllGetClassObject
mf3216
Mf3216DllInitialize
Sections
.text Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 102KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 115KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ